academic-research

SUSPICIOUS: the core paper-research purpose is benign and mostly aligned, but the skill encourages transitive trust in additional MCP servers via unpinned `npx -y` installs using ambiguous package names. That creates moderate supply-chain risk without clear evidence of malware or credential theft in the provided content.