start-core

SUSPICIOUS. The skill’s purpose is coherent and mostly benign as a TanStack Start setup guide, but it expands execution trust with unpinned `npx` installs and especially a third-party `gitpick` CLI unrelated to TanStack. No credential harvesting or exfiltration is present, so this is not malicious; the main concerns are supply-chain and external-content trust.