goose

SUSPICIOUS: the skill is broadly aligned with its purpose as a Goose guide, but it enables a high-impact agent footprint and includes credential forwarding to external MCP server code via unpinned `npx` installs. No direct malware, hidden execution, or explicit exfiltration is shown, but the combination of broad system agency, third-party extension execution, and secret passing makes it medium/high risk.