memory-fabric

SUSPICIOUS. The skill’s stated purpose and most capabilities are coherent for a memory-retrieval internals guide, and there is no clear credential harvesting or exfiltration path. However, it depends on an unpinned npx-installed MCP package whose official Anthropic provenance could not be verified, which creates a substantial supply-chain and transitive trust risk disproportionate to a documentation-style skill.