foam-setup

SUSPICIOUS. The core Docker troubleshooting behavior fits the stated purpose, but the skill also instructs transitive installation of another skill and use of third-party CLIs, plus unpinned `:latest` images and optional raw-script execution. Data flows are mostly same-org or official and there is no clear credential theft or exfiltration, so this is not malware, but it carries meaningful supply-chain and trust-chain risk.