iran-downloads

SUSPICIOUS. The stated purpose and read-only capabilities are mostly coherent, and the skill does not seek credentials or perform transactions. The main concern is install trust: it runs an external MCP package via `uvx` whose exact provenance was not verified, plus it may route requests through an arbitrary HTTP proxy outside official service endpoints.