hh-mcp

SUSPICIOUS. The skill’s purpose and API scope are broadly coherent for an hh.ru MCP integration, and the install path uses official tooling and PyPI rather than an arbitrary downloader. However, it forwards a powerful hh.ru token to a third-party MCP package from a personal publisher, not official HeadHunter tooling, while enabling write and irreversible employer actions. This is not confirmed malware, but it is a meaningful trust and credential-handling risk.