israeli-tender-proposal-builder

SUSPICIOUS: the skill’s stated purpose is mostly coherent and low-risk, but its recommended integration surface is not fully consistent with that purpose. The main concern is supply-chain trust: one optional MCP (IL Budget) appears to require local installation from a personal GitHub repo despite the skill claiming the MCPs need no local setup. No strong evidence of credential theft or malicious exfiltration appears in the skill content itself, so this is better classified as a medium/high-risk vulnerable skill rather than confirmed malware.