mcp-server-catalog-reference

SUSPICIOUS: the skill is largely a documentation/catalog guide and its capabilities match that purpose, but it materially increases risk by recommending transitive installation of many MCP servers, including community packages and a free-hosted GitHub MCP endpoint inconsistent with current official documentation. No confirmed malware or hidden exfiltration is present in the skill itself, but the install trust and downstream credential-routing posture are medium-high risk.