pippit-skill

SUSPICIOUS: the skill is mostly purpose-aligned for Pippit creation and publishing, and the visible data flow points to the official Pippit service rather than an obvious third-party collector. However, it performs real-world social posting, reads a locally cached access key, and the public provenance for the referenced local script wrappers is weak, so the overall risk is medium rather than benign.