pp-vestaboard

SUSPICIOUS: The skill's purpose and capabilities mostly align, and data flow to Vestaboard endpoints is stated clearly. Risk comes from requiring a non-vendor third-party CLI/MCP tool from a personal publisher, unpinned install paths, and optional arbitrary webhook delivery; this is more supply-chain and credential-forwarding concern than confirmed malicious behavior.