pp-cal-com

SUSPICIOUS. The skill's calendar-management purpose broadly matches its capabilities, but it depends on a non-official third-party CLI and optional MCP server that receive Cal.com credentials and can post results to arbitrary webhooks. Same-publisher provenance reduces malware certainty, yet the install trust and credential-forwarding footprint are larger than necessary for a normal Cal.com skill.