pp-framer

SUSPICIOUS. The skill is largely coherent with its Framer automation purpose and uses same-org install sources, so it does not look malicious. However, it expands trust to external CLI/bridge code, uses unpinned source installs, forwards Framer credentials into that code, and supports arbitrary webhook delivery plus real project mutations, which makes it medium risk for an AI agent workflow.