pp-shopping

SUSPICIOUS. The core shopping capability is coherent and the install sources appear to be official same-org npm/Go distribution paths, so this is not strongly indicative of malware. However, medium risk remains from unpinned installer execution, arbitrary webhook output delivery, and transitive MCP installation; these expand data-flow and trust beyond a narrowly scoped retail query skill.