patchxnote-mcp

SUSPICIOUS: the skill’s purpose mostly matches its capabilities, and its security guidance is unusually defensive rather than deceptive. The main concern is transitive trust in an unpinned `npx @latest` CLI that installs/configures the integration and may handle auth state, which creates meaningful supply-chain risk even though the package appears same-project and registry-hosted; overall this is better classified as medium-risk vulnerable than malicious.