pp-hotel-goat

Overall this skill looks mostly coherent for hotel search, but it carries medium risk from third-party CLI/MCP installation, unpinned installer paths, unclear publisher-to-source alignment, and optional arbitrary webhook delivery. It is not clearly malicious, but it is more expansive than a simple read-only hotel lookup skill.