mcp-server-shipping

SUSPICIOUS. The skill’s purpose and capabilities mostly align, and its data flow stays within uv, GitHub, and Claude MCP configuration without credential harvesting or hidden exfiltration. However, it normalizes installing executable MCP server code from a personal GitHub repo via `uv tool install git+...`, including unpinned branch-based installs, which is a meaningful supply-chain risk disproportionate to a documentation-only workflow.