pp-apartments

SUSPICIOUS: the apartment-search purpose mostly matches the CLI behavior, but trust boundaries are looser than necessary. Main concerns are unpinned third-party binary installs, publisher mismatch, arbitrary webhook output, and MCP transitive installation; credential theft evidence is limited because no auth is required.