zabbix-mcp-server

SUSPICIOUS. The skill’s Zabbix access, credentials, and data flows fit its stated purpose, and calls go to the user’s Zabbix server rather than an unrelated proxy. The main risk is install trust: it recommends executing code from an unpinned GitHub branch via uvx, and the referenced repo owner differs from the stated skill publisher, so provenance is weaker than an official registry release or immutable pin.