agent-bootstrap

SUSPICIOUS: the skill's local validation/configuration behavior is mostly aligned with its purpose, but it materially exceeds its stated 'no external dependencies' principle by installing remote skills from third-party sources. The main risk is transitive trust and supply-chain exposure through `npx skills add` and raw URL downloads, not confirmed malware or credential theft.