pp-fred

SUSPICIOUS. The skill’s capabilities broadly match its stated FRED purpose and its credentials target the official FRED API, so this is not fundamentally incompatible or overtly malicious. However, it requires installation of same-org external binaries, uses unpinned `go install @latest` fallbacks, includes MCP/transitive tooling trust, and offers arbitrary webhook delivery that can route fetched data to third-party URLs. Overall this is a coherent but medium-risk skill due to supply-chain and optional data-routing exposure, not confirmed malware.