pp-3cx-xapi

SUSPICIOUS: The skill’s purpose and capabilities mostly align with a full 3CX admin/audit tool, and its install sources are same-org and publicly traceable. However, it relies on external binaries, forwards OAuth credentials to them, supports arbitrary webhook delivery, and exposes many high-impact administrative actions; this is coherent but materially risky for an AI agent.