security-detections-mcp

SUSPICIOUS: the skill’s main capabilities align with its stated detection-engineering purpose, and its primary hosted endpoint appears official. Risk comes from unpinned npx execution and especially hosted mode’s reliance on third-party mcp-remote to handle bearer tokens before forwarding to the official service; that is a meaningful credential and data-flow trust expansion, but not clear malware.