3x-ui-setup

SUSPICIOUS: the core server-admin and VPN capabilities broadly match the stated purpose, so this is not clearly malicious, but the trust model is weak. It performs root-level remote execution from GitHub-hosted artifacts, runs an external scanner binary, suggests credential forwarding via sshpass, and contradicts itself by storing passwords in guide files despite claiming not to. The skill is coherent as a VPN setup playbook, but its install/execution trust and secret-handling are riskier than necessary.