pp-gladly

SUSPICIOUS. The skill is mostly coherent with its stated read-only Gladly purpose and uses same-owner install sources, but it relies on a non-official third-party CLI with unpinned installs and can send retrieved data to arbitrary webhooks. This is not confirmed malware, but it has meaningful supply-chain and data-handling risk.