hookshot

SUSPICIOUS: the skill’s behavior largely matches its stated purpose of generating warning-only repo hooks, with local doc reads and local file writes that are proportionate. Main risk is install/runtime trust: it relies on third-party skill distribution via `npx skills add`, and the optional markdown-lint hook forwards file paths to `npx markdownlint-cli2`, adding supply-chain exposure without strong same-org verification in the skill itself.