setup

SUSPICIOUS: the skill's basic checks fit a setup/preflight purpose, but it depends on an unverifiable or at least publicly unverified catalyst-skills CLI and an install path inconsistent with cited public docs. Data flow to the configured tenant API is proportionate, yet reading a local key from config and using it directly adds moderate credential-handling risk.