pp-whoop

SUSPICIOUS: the skill’s purpose and capabilities are mostly aligned for a WHOOP CLI wrapper, but it materially expands trust to external binaries from same-publisher personal sources, including an unpinned Go install path and optional MCP binary. Data flows are largely proportionate, though --deliver webhook can exfiltrate command output to arbitrary URLs if the user/agent chooses it. No confirmed malware or hidden execution was found.