pp-weather-goat

SUSPICIOUS. Core weather capabilities fit the stated purpose and no credentials are requested, but the skill depends on an external mutable CLI install and includes generic webhook/feedback delivery features that exceed a narrowly scoped weather tool. Risk is moderate rather than malicious because the main data flow is still consistent with weather use and official public-data APIs.