jy-chenhui-summary

This skill appears to do what it says (summarize partner broker research via the GilData/MCP service) but review and mitigate a few practical risks before installing: - The SKILL.md requires a JY_API_KEY though the registry metadata does not declare it. Expect to obtain and supply a service API key — this is necessary and proportional, but confirm you are comfortable providing it. - The install uses npm: inspect the 'mcporter' package (npm listing, repository, maintainer, recent downloads) before running `npm install -g mcporter`. Global npm installs run third-party code and may require elevated privileges. - The instructions show adding the token in the URL on the command line (mcporter config add ...?token=...). Avoid pasting secrets directly into shell commands where possible (shell history and process lists can leak them). Prefer secure config options if mcporter supports them, and remove sensitive commands from shell history afterward. - Check how mcporter stores credentials locally (config file path shown in docs) and ensure the config file is protected (file permissions) and you can rotate/revoke keys. Use a least-privilege key and rotate it periodically. - If you need stronger assurance, ask the skill author for: (1) exact mcporter package repository link, (2) confirmation whether mcporter stores tokens encrypted, and (3) an option to supply the key via environment variable or an interactive prompt rather than via command-line URL. If you accept those mitigations and verify the mcporter package origin, the skill's behavior is coherent with its purpose. If you cannot verify the npm package or are uncomfortable with storing/pasting the API key as shown, consider not installing.