amazon-sorftime-research-mcp-skill

SUSPICIOUS: The skill's core capability matches its stated Amazon research purpose, and the Sorftime integration appears broadly legitimate. However, it forwards multiple API keys to remote MCP services, embeds credentials in URL query strings, uses an SIF configuration that conflicts with official docs, and references an Xiyou MCP endpoint that could not be independently verified. This is not confirmed malware, but the install/auth/data-flow story is inconsistent enough to warrant caution.