n8n-mcp-setup

SUSPICIOUS: the skill is mostly coherent as a setup guide, but it tells the agent/user to execute and trust a non-official third-party MCP server and to pass an n8n API key into it. The npm path has some publisher verification, so this is not confirmed malware, but it carries meaningful supply-chain and credential-forwarding risk.