ccpi-marketplace

SUSPICIOUS: the skill is coherent with its stated marketplace-management purpose and uses a real npm-distributed CLI, but its main function is to install and manage other plugins/skills, creating meaningful transitive supply-chain risk. No direct credential harvesting or clear exfiltration is evident, so this looks more like a risky installer/orchestrator than malware.