architecture-decisions

SUSPICIOUS. The core ADR workflow is coherent and low-risk, but the optional instruction to install another skill from a third-party repo introduces a meaningful transitive-trust and supply-chain risk disproportionate to a documentation/process skill. No direct malware, exfiltration, or deceptive behavior is evident.