pipa-follow-up-reminders

SUSPICIOUS: the skill’s reminder capabilities broadly match its stated purpose, but it routes secrets and user data through a Fly.io gateway domain instead of a clearly official API domain, reads/writes raw credential files, and includes a checkout/payment flow with autonomous real-world effects. No malware indicators or install-chain attacks are present, but the data-flow and trust model are stronger than necessary for a simple reminder skill.