setup-devroot

SUSPICIOUS: the skill's purpose is coherent, but it relies on a multi-step remote trust chain: GitHub-authenticated fetching of template content, installation of all skills from another repo, and execution of the fetched workspace's own setup script. That makes it higher-risk than a normal documentation skill even without direct evidence of exfiltration or credential theft.