setup-falcondev-oss-skills

No explicit malicious behavior is evident within the wrapper itself (no obfuscation, no local backdoor logic, no direct exfiltration). The dominant risk is supply-chain exposure: the script executes an unpinned remote CLI (`skills@latest`) via transient package-manager runners and then performs global installs/additions from external repositories, including a wildcard `--skill '*'` that depends on upstream contents. This should be mitigated by pinning versions, verifying signatures, constraining args, and reducing scope before running in sensitive environments.