chip-trade-skills

This connector appears to implement what it says (it reads part numbers locally and calls a remote quote API), but exercise caution before installing: - The registry metadata is inconsistent: the code requires QUOTE_ENGINE_URL and QUOTE_ENGINE_API_KEY even though the manifest lists none. Expect to provide those env vars. - Do not paste your real API key into shared JSON/config files that may be checked into backups (the example suggests adding the key into claude_desktop_config.json). Prefer setting environment variables at runtime or using a secrets store. - Audit mcp_connector/server.py before running it to confirm it only exposes local MCP endpoints and does not accept arbitrary inbound network requests or perform unexpected network activity. - Verify the QUOTE_ENGINE_URL domain (api.ic-navigator.com or any self-hosted URL) is trustworthy; the connector will send part_number and qty to that endpoint. If you need to avoid any network calls, do not run the connector. - Confirm your spreadsheet column headers are covered by the connector's price-detection heuristics (the code blocks common price keywords, but strange/obfuscated headers may bypass detection). Consider running the connector in a controlled environment first and inspect outbound requests (e.g., with a network proxy) to confirm only part numbers/qty/lang are sent. If you cannot validate the endpoint or do not want to expose part numbers externally, do not install/run this skill. If you proceed, run it under a non-privileged account, avoid storing secrets in shared files, and review the server code and network traffic.