endpoint-probe

SUSPICIOUS. The HTTP probing behavior is broadly aligned with the stated endpoint-discovery purpose and includes reasonable SSRF safeguards, but the MCP stdio feature materially increases risk by allowing package runners to download and execute third-party server code, then forward credentials into those processes. That combination is proportionally risky for a discovery skill and warrants elevated security concern despite not being confirmed malware.