mcp-code-execution-mode

SUSPICIOUS. The core purpose mostly matches the capability, but the trust chain is not clean: ara.so branding does not line up with the referenced repo/image publisher, and the documented pip package name appears inconsistent with upstream metadata. The skill also acts as a transitive access bridge to any configured MCP server, including credentialed services and public-posting tools, which materially broadens scope and prompt-injection exposure. No confirmed malware or explicit exfiltration is shown, but the install provenance mismatch and broad proxying make this higher-risk than a typical documentation skill.