import-export-trade-data-leads

SUSPICIOUS/medium-risk rather than malicious. The skill's purpose and capabilities mostly align, and the MCP add command appears to target an official ManyPI endpoint, but it creates a live third-party trust boundary: user queries and any granted MCP credentials flow through ManyPI rather than directly to source datasets. Risk comes from remote-service dependency and credential forwarding opacity, not from confirmed malware or overt exfiltration behavior.