pp-rapidapi

SUSPICIOUS. The skill’s functionality mostly matches its stated purpose, but it asks the agent to install and trust a third-party CLI that is not an official RapidAPI tool, then forward a RapidAPI account token to it. Data flows are mostly disclosed and same-org installer provenance is verifiable, so this is not confirmed malware. Main risks are third-party credential forwarding, unpinned install paths, local journaling/learning side effects, and optional arbitrary webhook delivery that extends data flow beyond RapidAPI.