forma-cli

SUSPICIOUS. The core workspace-inspection behavior is coherent, but the skill expands trust by requiring a GitHub-script-installed CLI and then installing another skill through that CLI. No direct credential theft or exfiltration is shown, yet the transitive installation and unverifiable install path make this higher risk than a normal local tooling guide.