setup-skill-discovery

SUSPICIOUS: the core behavior is mostly aligned with a skill-discovery wizard, but it expands trust to external marketplace skills and runs npm-managed CLI code via `npx`. No strong evidence of credential theft or malicious exfiltration appears, yet the transitive skill-loading and external-content reasoning make it a medium-risk skill rather than clearly benign.