pp-linq

SUSPICIOUS: the messaging capability matches the stated purpose, but the skill’s trust model is disproportionate because it routes Linq credentials and actions through a community-maintained third-party CLI/MCP rather than an official Linq tool. The arbitrary webhook delivery feature and real-world messaging actions further raise risk, though there is no confirmed hidden exfiltration or malware behavior in the skill text itself.