inboxmate-demo

SUSPICIOUS: the skill is broadly aligned with its stated demo-creation purpose and avoids download/execute patterns, but it combines untrusted web scraping with autonomous publication of live demo assets and forwards a bearer token to a same-domain but not publicly documented MCP API. Main risk is medium operational/data-flow risk rather than confirmed malware.