bioresearcher-deep-research

SUSPICIOUS. The research/reporting behavior and requested credentials are broadly consistent with a biomedical deep-research skill, and there is no clear exfiltration or concealment in the visible instructions. However, the recommended execution path relies on an external npm-installed MCP server, and the provided evidence says that package/install guidance does not align with the publisher's official BioMCP docs, introducing meaningful supply-chain and credential-forwarding risk.