astro-starlight

SUSPICIOUS. The core Starlight setup guidance is coherent and mostly benign, with official npm/Docs paths for Astro itself. Risk comes from mandatory transitive agent installation/research steps and reliance on community plugins whose provenance is mixed; no direct credential theft or malicious execution is evident.