pp-1password

SUSPICIOUS: the skill's purpose broadly matches secret-management workflows, and it uses official 1Password auth patterns, but it requires a non-official wrapper CLI with mutable install paths and can route potentially revealed secret output to arbitrary webhooks. This is coherent but higher trust than the stated 'agent-safe' framing suggests, so it should not be treated as low-risk.