sales-groupapp

SUSPICIOUS: the core GroupApp-help purpose is mostly coherent, but the skill includes two disproportionate trust/data-flow issues: a recommendation to send live webhook payloads to webhook.site and a transitive remote skill installation command. The official npm/GitHub provenance reduces pure supply-chain concern, but overall risk is medium-high due to exfiltration-oriented debugging guidance and inherited trust in another skill.