genius

SUSPICIOUS: the skill’s purpose is coherent, but it relies on an unofficial third-party proxy/MCP service that intermediates all Genius access and receives OAuth/API credentials and data. No malware or command injection is evident, yet the data flow is materially different from direct use of an official Genius API, making this a medium-risk trust and credential-routing concern rather than a benign first-party integration.