packagist

SUSPICIOUS: The skill's stated purpose is Packagist search, but it routes all activity through Unbrowse's unofficial third-party MCP and requires Unbrowse credentials even though Packagist has a first-party public API. No malware or direct exploit behavior is evident, but the intermediary credential/data flow and broader generic browsing capabilities make it higher-risk than a direct Packagist integration.