nimble-web-expert

The fragment is setup documentation for a remote MCP integration. It contains no direct evidence of malware, sabotage, data theft, or unauthorized system control. It does introduce supply-chain and credential-handling risks by recommending unpinned global npm installation, executing npx mcp-remote@latest, trusting remote MCP endpoints, and storing API keys in plaintext settings and command text. Pin package versions, verify provenance and integrity, protect settings file permissions, and avoid embedding tokens in shell history or configuration where possible.