setup-mcp-connector

SUSPICIOUS: the skill’s purpose is coherent, but it expands trust to several third-party CLIs and publisher-hosted proxy MCP endpoints, including one flow where a CLI directly receives a user API key. This is not fundamentally incompatible with a connector-setup skill, but the intermediary data flows and credential-forwarding make the footprint medium/high risk rather than benign.