pp-dreaming

SUSPICIOUS. The skill's capabilities mostly match its language-learning purpose, but it requires high trust in third-party tooling: remote install via same-owner npm/go paths, unofficial API use, credential entry into the CLI, and optional arbitrary webhook delivery. This is not confirmed malware, but the install and credential/data-flow footprint is broader than a simple tracker skill and warrants medium risk treatment.