glean-install-auth

SUSPICIOUS. The skill's purpose, token scope, and direct data flow to official Glean tenant endpoints are broadly coherent and proportionate, with no obvious exfiltration or hidden execution. However, the install instructions point to a package that does not match Glean's documented official SDK namespace, creating a meaningful supply-chain trust inconsistency for an auth/setup skill.