pp-trigger-dev

SUSPICIOUS: the purpose is plausible, but the trust chain is mismatched. A Trigger.dev management skill asks for a real Trigger secret key, then routes usage through a personal third-party CLI/install system rather than an official Trigger.dev tool; optional webhook/feedback delivery adds extra exfil paths. This is better classified as high supply-chain and credential-forwarding risk than confirmed malware.