spellbook-setup

SUSPICIOUS leaning moderate-risk, not overtly malicious. The skill's behavior broadly matches its setup purpose, but it installs a large trust surface from personal GitHub repos, includes transitive skill installation, and enables automatic hooks and persistent memory. Main concern is supply-chain and downstream trust, not clear credential theft or incompatible behavior.