pp-sensortower

SUSPICIOUS: the core purpose is coherent with mobile ranking analysis, but the skill depends on externally installed CLIs from a different publisher identity, can import browser session cookies, and includes arbitrary webhook/output routing plus MCP transitive installation. These are not clear malware signals, but they create medium supply-chain and data-flow risk beyond a minimal read-only analytics skill.