pp-catasto

SUSPICIOUS. The skill’s core read-only cadastral lookup behavior is coherent, and the documented npm/Go install paths appear tied to the same Printing Press project rather than a random third party. However, it still requires trusting an external binary, uses an unpinned Go install fallback, supports arbitrary webhook output delivery, and includes MCP registration that extends trust to another executable. These are moderate security risks, but there is no clear evidence of credential harvesting or overtly malicious behavior.