pp-jobber

SUSPICIOUS: the core purpose and read-only Jobber analysis capabilities are coherent, and the installer appears same-org and documented. However, the skill expands trust by installing/running an external CLI, supports transitive MCP installation, handles high-value OAuth secrets, and can exfiltrate output to arbitrary webhook URLs. These risks are not enough to call it malicious, but they are broader than a minimal offline-analysis skill.