piu-backend-sync

SUSPICIOUS. The skill's main capabilities broadly match its stated backend-sync purpose, and its visible dependencies are not obviously malicious. However, it clones arbitrary repos, processes untrusted repository content while holding write/action privileges, and routes extracted data plus possible tokens through opaque local MCP tooling whose actual backend endpoints are not disclosed. This is a coherent but medium-risk integration skill rather than confirmed malware.