pp-aol-puglia

SUSPICIOUS: the skill’s stated purpose is coherent, but it relies on externally installed CLI/MCP binaries from a publisher relationship that is not obvious in the skill, forwards bearer credentials to that CLI, and supports arbitrary webhook delivery of outputs. This looks more like moderate trust and data-flow risk than confirmed malicious behavior.