mcp-server-setup

SUSPICIOUS: the stated purpose is coherent, but the skill normalizes storing raw credentials in a shared file and forwarding them to npm-fetched MCP server packages, including at least one ambiguously sourced package name. Official npm tooling lowers concern, yet unpinned runtime installs plus credential forwarding to third-party server code create a meaningful supply-chain and secret-exposure risk.