setup-mcp-connector

SUSPICIOUS. The skill's overall purpose is coherent, and most OAuth/setup guidance is proportionate, but it mixes official auth flows with third-party hosted MCP proxies and external npx-installed tooling that receives user API keys. The most significant issue is data flow: the law connector routes a user-specific government API key through a publisher-hosted domain, and the dart setup relies on third-party package execution, including an unpinned @latest path. This is not confirmed malware, but it is a medium-high trust and credential-forwarding risk.