data-building-ledger

SUSPICIOUS: The skill’s purpose is coherent, but its actual data path relies on a private MCP proxy with a shared server-side key instead of direct calls to official government APIs. Normal use avoids user secrets, so this is not confirmed malware, but the third-party routing and optional credential forwarding to personal-repo code make the trust model broader than the stated public-data lookup purpose.