google-forms

SUSPICIOUS. The purpose and requested Google credentials are broadly consistent with a Google Forms integration, and the intended external data flow appears to be to official Google APIs. However, the skill tells the user to build and run an unverifiable local MCP project and then supply OAuth secrets and a refresh token to it; that combination makes the install/execution trust weak and creates meaningful credential-forwarding risk even without proof of malicious intent.