pp-render

SUSPICIOUS. The skill's capabilities mostly align with Render administration, but it relies on a third-party community CLI and MCP binary, then forwards official Render API credentials into that external tooling. The install paths are same-ecosystem and open-source rather than obviously malicious, so this is not confirmed malware, but the combination of unpinned installs, credential forwarding, destructive admin actions, and arbitrary webhook output makes it a medium-high risk skill.