ai-harness-setup

The supplied text is documentation for a repository bootstrapping skill and does not itself demonstrate malware. It does document two supply-chain-sensitive installation mechanisms: piping an unverified remote script to a shell and installing unpinned content from GitHub via npx. Review and pin the installer and repository revision, inspect the resulting changes, and execute installation with least privilege. The actual skill implementation must be analyzed separately.