memory

SUSPICIOUS. The skill’s behavior is mostly aligned with its read-only memory purpose and shows no clear malicious or exfiltration behavior, but trust is weakened by reliance on a private, publicly unverifiable dependency (yg-mcp-core) and an unspecified MCP backend. Main risk is install/provenance uncertainty rather than confirmed malware.