smart-search

SUSPICIOUS: The skill's behavior is mostly aligned with its stated purpose, but installer trust is weak because the required yuque-mcp server is not pinned or publisher-verified and would hold a personal Yuque token. No clear malicious behavior or off-purpose data flow is shown, but the ambiguous third-party MCP dependency raises meaningful security risk.