sage

SUSPICIOUS. The skill's purpose and capabilities generally align, but it forces use of external MCP services—especially a third-party researcher stack—instead of native tools, creating unnecessary trust and prompt-injection exposure. No clear credential theft or malicious exfiltration is shown, but the external-content processing and third-party tool dependency make the skill medium-to-high risk.