conductor-setup

SUSPICIOUS: the core scaffolding behavior is mostly coherent, but the optional catalog-driven curl installation of other skills is a disproportionate and risky transitive trust mechanism. The main concern is supply-chain expansion into .agents/skills without strong provenance or integrity controls, not confirmed malware.