pp-zoom

SUSPICIOUS. The skill's Zoom/local-recording purpose is plausible, but it relies on third-party binaries installed via unpinned same-org tooling, misstates authentication requirements for OAuth-gated features, and can route sensitive meeting data to arbitrary webhooks or feedback endpoints. This is not confirmed malware, but it is a high-risk external-CLI skill with meaningful credential-forwarding and exfiltration potential.