setup

SUSPICIOUS: The skill’s behavior mostly matches a setup wizard for a tax CLI and there is no clear exfiltration path, but it handles extremely sensitive personal data and installs/upgrades executable code from an unpinned personal GitHub repository. The main concern is supply-chain trust and plaintext local storage of tax identifiers, not confirmed malicious intent.