mcm-master

SUSPICIOUS. The overall purpose is coherent for an MCM/ICM writing/modeling skill, but its footprint is broader than necessary: it executes unverifiable local plugin code, streams detailed reasoning to a localhost HTTP receiver, and combines untrusted web research with code/file execution. No confirmed malware or overt credential theft is shown, but the install trust and data-flow design create high security risk for a skill of this type.