pp-human-goat

SUSPICIOUS: the skill is internally coherent, and the installer appears same-org rather than a random third-party payload, so this is not confirmed malware. However, it enables autonomous real-world purchases and service actions against stored payment/auth credentials, plus optional webhook delivery, making the overall skill high risk even though the command-injection findings are false positives.