pp-gumroad

The skill's purpose is coherent, but its actual footprint relies on installing and trusting external Gumroad CLI/MCP binaries whose provenance is not verified in the skill. Because that binary receives a Gumroad access token and can send output to arbitrary webhook endpoints, this is best classified as suspicious/high-risk rather than benign.