pp-sutra-fitness

The skill is mostly aligned with a studio-analytics purpose, but it expands risk through external binary installation, a second MCP binary, and arbitrary webhook/feedback delivery paths that can exfiltrate synced client and business data. This looks more suspicious than benign due to broadened data flows and incomplete provenance clarity, but not confirmed malware.