native-mcp

SUSPICIOUS. The skill’s stated MCP-client purpose is real, but its footprint is high-risk: it enables arbitrary subprocess/package execution, forwards secrets to third-party MCP servers, auto-injects discovered tools into all conversations, and allows server-initiated LLM/tool workflows by default. No direct malware or hidden exfiltration is shown, but the trust model is too broad for a low-risk skill.