pp-mobbin

SUSPICIOUS: the skill's core purpose is plausible, but its footprint is broad for a design-reference tool. Browser-cookie import, local secret storage, arbitrary webhook delivery, direct Supabase write calls, and transitive MCP installation make the trust and data-flow model riskier than the description suggests, though there is not enough evidence to call it confirmed malware.