pipa-time-tracking

SUSPICIOUS: the skill’s capabilities mostly match time tracking, but it forwards credentials and user data to an unverified Fly.io gateway and reads/stores raw credential files locally. The main risk is weak endpoint provenance and credential handling, not malware or installer abuse.