pp-ticketmaster

SUSPICIOUS. The skill’s core purpose and capabilities are coherent for a Ticketmaster read-only workflow, and the install sources appear to be same-org and publicly documented rather than random third parties. The main risks are moderate supply-chain trust in an external CLI, unpinned Go fallback installs, and built-in background learning/output features (`teach`, webhook delivery, feedback endpoint) that can persist or route data beyond a simple query tool. Not enough evidence of malware, but broader than a minimal read-only API helper.