iblai-vibe-ops-init

SUSPICIOUS. The core bootstrap behavior is mostly coherent and uses an official iblai GitHub source, but the skill expands trust by installing another skill transitively and stores sensitive tokens locally. Main risk is transitive skill installation plus mutable GitHub-based scaffolding, not confirmed malware or overt exfiltration.