pp-dub

SUSPICIOUS: the skill is broadly aligned with Dub workspace administration and its credential needs are proportionate, but it materially extends trust to external same-org binaries, uses unpinned installers, and supports arbitrary webhook output delivery plus MCP registration. This looks coherent rather than overtly malicious, but it carries meaningful operational and data-leak risk for an AI agent.