pp-stac

SUSPICIOUS. Core STAC-search behavior and same-org npm/Go install paths are mostly coherent, but the skill mixes publisher identity, installs extra binaries/MCP components, and includes arbitrary webhook output delivery that can route data off-host beyond the stated discovery purpose. No confirmed malware or credential harvesting is evident.