processon-diagram-generator

SUSPICIOUS: the skill's core purpose is coherent, but it expands trust by forcing repo-based skill reinstallation through a generic skills CLI and by sending auth-bearing operations through external CLI tooling (`mcporter`) that is not clearly ProcessOn-owned. No confirmed exfiltration or outright malicious behavior is shown, but the install/update and credential-forwarding footprint is broader than ideal for a diagram generator.

No clear, direct evidence of intentional sabotage/malware is visible in this fragment. The primary security concerns are supply-chain execution (runtime `npm install -g mcporter@...`) and credential handling/exfil risk: bearer tokens are stored locally, written into `mcporter` config, and sent via HTTP Authorization headers to `config.mcpUrl` (including through a spawned `node -e` subprocess). If `config` values or token sources can be influenced, this could enable credential leakage. Additional review is needed for the unseen parts (e.g., run(), spawn(), saveLocalToken(), filesystem paths, and how `config` is populated).