mcp2cli-runtime-api-tooling

SUSPICIOUS. The core capabilities are coherent for an API-to-CLI runtime tool, and the documented uv/PyPI install path is proportionate and verifiable. The main security concerns are transitive trust from installing the skill through the third-party skills CLI and the ability to launch arbitrary local MCP stdio commands and forward secrets to those processes or to arbitrary user-specified endpoints; these behaviors fit the purpose but materially widen the trust boundary.