Project Scaffolding

The skill’s main purpose is coherent, but its trust model is weak: it instructs the agent to locate, copy, and persistently execute an unverified local shell script from `$CLAUDE_PLUGIN_DIR` or an arbitrary match under `~/.claude`. That makes this better classified as suspicious rather than benign, driven by local supply-chain and persistent auto-execution risk rather than clear malware or exfiltration.