keycloak-client-onboarder

SUSPICIOUS: the skill’s purpose is coherent, but it relies on a third-party Keycloak CLI/MCP that receives admin credentials and generated secrets. No clear malicious exfiltration path is shown, yet install trust and credential-forwarding risk are material enough to rate it suspicious rather than benign.