setup-harness

SUSPICIOUS: The core behavior is coherent with a repo-scaffolding/documentation skill and there is no evidence of credential theft, exfiltration, or hidden execution. The main risk is transitive trust: installation through the skills ecosystem and delegation to another skill (`hookshot`) from a third-party repo/org without independent review.