flytoday

SUSPICIOUS. The skill's travel-search behavior is broadly aligned with its purpose and it avoids credential collection, but it depends on an unofficial third-party MCP package from a personal publisher and suggests optional proxy routing through arbitrary infrastructure. This is a medium-risk trust and data-routing issue, not confirmed malware.