Amazon Analyse

This skill appears to do what it says (calls Sorftime MCP and writes Markdown reports), but before installing or running it confirm the following: - The skill requires a Sorftime MCP API key (examples show YOUR_API_KEY and README/.mcp.json). The registry metadata did NOT declare that credential — ask the author to add a required credential field or documentation on how the platform will provide the key. - Do NOT paste your API key into public chat or logs; prefer storing it in the agent/platform secret store or an environment variable accessible only to the skill. The examples put the key in the URL query string, which can leak in logs — request an authenticated header or secure config instead. - Verify the Sorftime endpoint (https://mcp.sorftime.com) and the author/owner identity before providing any secrets. The skill's source/homepage is unknown; lack of provenance increases risk. - Be aware the skill will create files under reports/ in the project. If you have sensitive workspace policies, confirm where reports are stored and who can access them. - If you need higher assurance, ask the author to: (1) declare a primary credential in the skill metadata, (2) prefer header-based authentication over query parameters, and (3) include a short integrity/privacy statement describing what data is sent to Sorftime and retention behavior. Given these issues (missing declared credential and insecure example usage), treat the skill as suspicious until the author clarifies credential handling and endpoint provenance.