magpie-setup

SUSPICIOUS: The skill's purpose and capabilities mostly align, but it has a broader-than-minimal footprint: remote snapshot downloads, mutable branch support, git-hook installation, worktree propagation, and transitive activation of additional skills. No clear credential theft or exfiltration is described, so this is not malware, but it carries medium security risk as a framework bootstrapper with supply-chain and trust-chain implications.