goose-ads

SUSPICIOUS: the core ad-generation behavior is coherent and same-org, but the skill materially expands scope by instructing runtime fetching/execution of additional GooseWorks recipes and scripts. Data flows mostly stay within GooseWorks, so this is not confirmed malware, but the transitive skill installation and mutable download-execute pattern make it medium-to-high risk.