pp-squarespace

SUSPICIOUS. The skill is broadly coherent with its stated Squarespace management purpose, and the installer appears to come from the same publisher ecosystem rather than an unrelated host. However, it requires a separately installed external CLI, forwards sensitive Squarespace token/cookie credentials to that binary, includes an unpinned `go install @latest` fallback, and can route outputs to arbitrary webhooks. This is not confirmed malware, but it carries meaningful supply-chain and credential-handling risk beyond a simple documentation skill.