pp-paperclip

SUSPICIOUS. The skill’s stated purpose broadly matches a management CLI, but it asks the agent to install an external binary from a third-party publisher path and then hand it Paperclip credentials and session cookies. That combination makes the footprint disproportionate to a normal documentation skill and triggers high supply-chain and credential-forwarding risk, though there is not enough evidence here to call it confirmed malware.