pp-scrape-do

SUSPICIOUS. The skill is mostly coherent with a scraping/governor CLI and uses same-org install sources, so it does not look malicious. However, mutable installer paths, MCP transitive trust, arbitrary webhook delivery, and a mild publisher-identity mismatch raise medium security risk beyond a purely benign documentation skill.