setup-work-skills

SUSPICIOUS. The skill’s purpose is coherent, but its actual trust model is weak: it installs multiple additional skills, executes an unseen local installer, and pulls mutable upstream content from a personal GitHub repository without clear pinning or release verification. No confirmed credential theft or exfiltration is visible from the provided text, but the supply-chain and transitive-install risks are high enough to treat it as risky.