pp-scrape-do

SUSPICIOUS. The core scraping/account-governor behavior fits the stated purpose, and the install sources are plausibly same-org and open source. However, the skill depends on external binaries installed via unpinned npm/go flows, forwards API credentials to that CLI, supports arbitrary webhook delivery, and includes MCP installation that extends trust to another executable. These are proportionate but materially increase security risk.