pp-mcpmarket

SUSPICIOUS. The core catalog-search capability fits the stated purpose, but the skill’s footprint is broader than necessary: it requires installing a third-party stateful CLI, persists local learnings automatically, instructs silent background writes before answering, and can route results to arbitrary webhooks or optional feedback endpoints. This is not confirmed malware, but the hidden side effects and outbound delivery features make the skill higher risk than a normal read-only search helper.