universal-db-mcp-connector

SUSPICIOUS: the skill's database-access purpose matches its capabilities, and the flagged curl/install patterns are mostly documentation. The main concerns are trust and scope: ara.so publishes instructions for a package maintained by a different owner, and the skill routes highly sensitive database credentials and data through that third-party MCP server, including over HTTP mode. Not confirmed malware, but materially risky due to credential forwarding and broad access to live databases.