neox-phone-mcp

SUSPICIOUS: the skill is broadly aligned with local phone-media access, but it adds an unauthenticated LAN bridge that can inject phone-originated messages into new agent turns. No strong malware or credential-theft evidence appears, and there is no remote binary install, but the auto-started bridge/watcher and unverified app provenance make the overall skill medium risk.