pp-concur

SUSPICIOUS: the skill’s core Concur automation is broadly aligned with its purpose, and the primary CLI install path appears same-org and documented. However, it relies on browser-session capture, adds a third-party browser automation dependency for hotel search, permits arbitrary webhook export of potentially sensitive expense/travel data, and has a publisher/source mismatch. This looks more like a high-exposure enterprise automation tool than clear malware.