global-chat-agent-discovery

SUSPICIOUS: the stated purpose is coherent, and the skill is unusually cautious, but the actual install trust is not clean. The named MCP package does not clearly match current official documentation, the linked source appears unavailable, and multiple similar npm packages create provenance ambiguity. No clear credential harvesting or exfiltration is described, but installing or invoking the MCP server should be deferred until publisher ownership, repository continuity, and the exact package name are independently verified.