pp-company-goat

SUSPICIOUS: the skill's purpose and capabilities are mostly aligned for startup research, and data largely flows to expected official sources. The main concern is install/execution trust: it requires a same-publisher but external, unpinned CLI and can forward optional credentials/tokens to that binary; webhook delivery also enables outbound routing of results. No strong evidence of outright malware, hidden exfiltration, or deceptive purpose was found.