I don't prefer to use online skills where half has malware

Official MCPs are trusted. Official MCPs CLIs are trusted.

Did he? Skills are for CLIs, not for converting MCPs into CLIs.