kindly-web-search-mcp-server

The skill's capabilities broadly match its stated web-search purpose, and its declared credentials are proportionate to search/GitHub extraction. The main concern is install trust: it asks users to install uv via pipe-to-shell and then run the MCP server directly from an unpinned third-party GitHub repo while forwarding API keys and optional GitHub tokens into that code. This is suspicious from a supply-chain standpoint but not strong evidence of malicious intent.