cyrus-setup

SUSPICIOUS: the skill's broad setup role is plausible, but it combines browser-driven credential scraping, remote-debugging session control, Bash access to secret-bearing config, and explicit transitive execution of multiple unseen sub-skills. The main concern is not confirmed malware but oversized trust and credential-handling risk for an orchestration skill whose full behavior depends on unreviewed sibling skills.