doctoreto

SUSPICIOUS. The skill's behavior mostly matches its read-only Doctoreto lookup purpose, and it does not request disproportionate credentials. The main risks are supply-chain trust in an unofficial personal-account MCP package and the recommendation to route traffic through an HTTP proxy, which could expose queries and responses to an intermediary.