pp-namecheap

SUSPICIOUS. The overall footprint is mostly coherent for a Namecheap CLI skill, and the install sources appear same-org and publicly documented. However, the skill is internally inconsistent: it presents itself as read-only while listing mutating domain/DNS operations, and it supports arbitrary webhook delivery of results. This looks more like an over-broad automation wrapper than confirmed malware.