setup

SUSPICIOUS: mostly coherent with a GBrain setup skill, but the trust footprint is larger than necessary. Main concerns are the unpinned GitHub/Bun install path that conflicts with upstream docs, persistent service installation, and optional handling of highly privileged Supabase secrets. Data flows go to official services rather than obvious exfiltration endpoints, so this is not confirmed malware, but it carries meaningful security risk.