phase-4-api

SUSPICIOUS. The skill’s core purpose is coherent, and the Bkend endpoint appears to be the vendor’s own service, so this is not confirmed malware. However, it asks the agent to trust an unverified third-party remote MCP server and send credentials/API context to it, creating a meaningful medium risk that is larger than a purely local API-design skill.