statsig

SUSPICIOUS. The skill's purpose and Statsig data flows are largely coherent and the MCP endpoint is official, but it relies on an unpinned third-party `mcp-remote` package that receives a privileged Statsig Console API key. This is not confirmed malware, but the install path and credential forwarding create medium security risk.