pp-suno

SUSPICIOUS: the skill is broadly aligned with its stated Suno-management purpose and uses same-org, source-visible install paths, so there is no strong evidence of malware or credential harvesting. However, it expands trust to an external CLI/MCP tool installed via npm or unpinned Go `@latest`, and it supports posting results to arbitrary webhooks, making the overall security posture medium risk rather than benign.