api-integration

SUSPICIOUS. The skill’s purpose and capabilities mostly align as a documentation-style API integration guide, and there is no clear credential theft or malicious exfiltration. However, it asks the agent/user to execute an unpinned npm package with ambiguous publisher/package provenance (`apidog-mcp-server@latest` vs `@apidog/mcp-server`), so install trust is weaker than expected and raises medium supply-chain risk.