setup-conventions

SUSPICIOUS: the skill’s repo-inspection and file-writing behavior mostly fits its stated setup purpose, and it includes explicit confirmation gates. The main concern is unverifiable provenance for the referenced `agentic-sdlc` CLI/assets and the external reusable workflow/ruleset source, which raises medium supply-chain risk even without overt malicious behavior.