init-fmz

SUSPICIOUS. The core bootstrap behavior is coherent, but the skill is over-broad: it reads raw local PAT files, creates and pushes GitHub repos automatically, and most importantly installs multiple external skills as a mandatory step. The main concern is transitive trust and supply-chain expansion beyond simple project initialization, not confirmed malware.