hostinger-headless

SUSPICIOUS: the skill's purpose broadly matches website setup on Hostinger, but its trust model is heavier than a simple bootstrap. Same-org GitHub sourcing reduces concern, yet the combination of raw-script download, unpinned `npx @latest` execution, and transitive skill installation makes the install path risky. No clear evidence of malware or credential exfiltration beyond Hostinger's own flow, but the skill should be treated as medium-high risk until package provenance and official docs alignment are clearer.