hap-mcp-app-builder

SUSPICIOUS. The core capability is mostly aligned with a Mingdao HAP app builder and uses official Mingdao MCP infrastructure, but the skill has moderate security risk from broad MCP wildcard authorization and an unpinned self-update mechanism that can pull and overwrite local skill files via Git. No clear credential theft or fundamentally incompatible behavior is present.