torob

SUSPICIOUS: The stated purpose is coherent and read-only, but the skill relies on an unofficial third-party MCP server and even recommends proxy routing through external infrastructure. No credential harvesting is evident, yet install trust and data-flow integrity are weaker than expected for a simple shopping lookup skill.