cf-add-integration

SUSPICIOUS. The stated purpose is coherent, and there is no direct credential harvesting or hidden exfiltration in the skill text. However, it steers users toward third-party MCP packages executed via npx and then configured to receive API credentials, creating meaningful supply-chain and credential-forwarding risk even though the skill itself is configuration-focused.