pp-ticktick

SUSPICIOUS: The skill’s purpose and capabilities mostly align, and the install sources appear to be the publisher’s own documented npm/GitHub/Go paths rather than a random payload. However, it expands trust to external CLIs, uses unpinned install methods, accepts high-value TickTick credentials including password/session token, and allows arbitrary webhook delivery of output, so the overall footprint is broader than a minimal TickTick helper.