pp-raindrop

SUSPICIOUS. The skill's capabilities broadly match Raindrop bookmark management, and token flow to api.raindrop.io is consistent with purpose. Main concern is supply-chain trust: the skill requires a same-publisher but externally installed CLI, with a live unauthenticated catalog in the npm installer and an unpinned Go fallback. Optional webhook delivery and autonomous background learning writes add moderate risk but are still related to the stated function.