pp-google-tag-manager

SUSPICIOUS: The skill’s core purpose and GTM-readonly capabilities are broadly coherent, but it requires installing a third-party CLI and forwarding a live Google OAuth bearer token into that CLI. Provenance appears same-owner and source-visible rather than obviously malicious, so this is not confirmed malware; however, external credential forwarding plus optional arbitrary webhook delivery make the footprint riskier than a simple documentation or API-only skill.