pp-strava

SUSPICIOUS: mostly coherent Strava analytics functionality with same-org install paths, but the skill's footprint is broader than simple analytics because it installs an external CLI, can forward outputs to arbitrary webhooks, supports account-modifying bulk actions, and instructs MCP registration. No clear evidence of malware or deceptive exfiltration, but the combined supply-chain and data-routing surface makes it medium risk.