pp-booking-com

SUSPICIOUS: the core purpose and capabilities are mostly aligned, and the install sources appear same-project and source-available, but the skill materially expands trust by installing an external CLI, importing Booking session cookies, allowing arbitrary webhook delivery, and optionally installing an MCP server. This looks like a high-privilege travel automation skill rather than overt malware, but its authenticated data access and export paths make it medium risk.