pp-apify

SUSPICIOUS. The skill’s capabilities are broadly aligned with Apify operations, and data mostly flows to Apify or user-chosen sinks, so this is not confirmed malicious. However, it requires installing a same-publisher external CLI/MCP tool and then granting it APIFY_TOKEN-powered account access; the installer and Go fallback are mutable/unpinned, and output can be posted to arbitrary webhooks. That combination makes the skill higher-risk than a normal guide and warrants caution.