boring-new-app

SUSPICIOUS. The repo-bootstrap purpose is plausible, but the skill executes unpinned code directly from a GitHub repo and feeds it high-value credentials (`FACTORY_TOKEN`, `CURSOR_API_KEY`, optional Claude token). It also asks the user to install another skill, creating transitive trust. The main concern is supply-chain and credential-forwarding risk, not confirmed malware.