mcp-light-generator

SUSPICIOUS. The skill’s core behavior matches its stated purpose, but it generates a proxy that executes an arbitrary user-selected MCP server through unpinned npx at runtime, creating a meaningful supply-chain risk. No clear credential theft or malicious exfiltration is present, but the install/execution trust is broader than ideal for a lightweight description-compression skill.