setup-project-context

SUSPICIOUS: the core behavior fits the stated purpose of building project context from local code and GitHub history, and its direct tooling footprint is mostly proportionate. The main risk is transitive trust: it requires other skills by name, especially /context-engineering, without pinning a verified source, creating a meaningful supply-chain and inherited-permissions concern even though no explicit malicious data flow is shown.