pp-contact-goat

Purpose and capabilities mostly align for a contact-enrichment skill, but the footprint is broader than a simple helper: it installs external tooling, forwards API keys/cookies, reads a local credential file, and can register an MCP server. This is not clearly malicious, but it is a medium-risk skill that should be treated as suspicious unless the publisher/install sources are independently verified.