grounding-lite

SUSPICIOUS: The skill’s core purpose and Google API data flow are coherent, but it introduces an unnecessary third-party CLI (mcporter) that receives the API key before sending requests to Google. This is not strong evidence of malware or exfiltration, yet the extra credential-forwarding layer and unpinned third-party install make it medium risk rather than benign.