pp-vagaro

SUSPICIOUS. The skill is mostly coherent with its stated Vagaro discovery/booking-assist purpose, and the installer provenance appears same-owner and official enough to avoid a malware verdict. However, it expands trust to external binaries, imports browser session credentials, supports arbitrary webhook output delivery, and instructs MCP installation; these combined make the footprint moderately risky for an agent skill.