new-project

The core project-setup purpose is coherent, but mandatory installation of multiple external skills introduces meaningful transitive trust and unpinned supply-chain risk. No evidence of credential theft, exfiltration, or confirmed malicious behavior is present.