pp-printing-press-golden

SUSPICIOUS. The skill’s purpose mostly matches a CLI wrapper, but it relies on an externally downloaded fixture binary that was not clearly verifiable, then forwards API credentials into it. Optional webhook delivery and MCP installation further widen risk. This is better classified as high vulnerability/supply-chain risk than confirmed malware.