project-init

SUSPICIOUS. The skill is largely coherent and purpose-aligned for local project scaffolding, with official GitHub CLI usage and no clear credential exfiltration. Risk is elevated by one optional unpinned clone from an unverified personal GitHub repo and by explicit installation/use of other skills, which creates transitive trust outside this skill’s reviewed footprint.