layer-workflow-import

SUSPICIOUS. The core behavior is coherent with a Layer workflow-import skill, and data flows stay within Layer-related tooling. The main concern is the explicit transitive installation of other skills through an unpinned third-party `skills` CLI, which creates avoidable supply-chain and trust-extension risk even though the target repo is same-org and officially documented.