new-project-setup

SUSPICIOUS due to transitive skill installation and opaque delegated behavior, not because the visible actions are inherently incompatible with project setup. The visible footprint mostly matches repo bootstrap, but the skill’s main effect is to install and invoke other skills/scripts, so overall risk is medium even without direct evidence of credential theft or exfiltration.