pp-strava

SUSPICIOUS: the skill's Strava analytics purpose is plausible, but it depends on external executables from a differently named publisher, forwards Strava credentials to that CLI, and includes arbitrary webhook delivery plus MCP installation. No direct malware indicators or hidden exfiltration are shown, but install trust and data-routing scope are significant enough for a medium-high risk classification.