pp-synology

SUSPICIOUS: the core Synology-management purpose broadly matches the capabilities, but the skill’s footprint is larger than necessary because it installs a separate CLI/MCP tool, stores and reuses credentials locally, supports arbitrary webhook delivery, weakens TLS via --insecure, and instructs autonomous background learning writes before replying. No confirmed malware or pre-execution exploit is present, but the trust and data-flow model is higher risk than a simple NAS query skill.