creating-projects

SUSPICIOUS: the skill is broadly aligned with project scaffolding, but it expands trust by loading other skills and relying on personal-publisher tooling for initialization. Data flows mostly go to official npm/GitHub services and local files, so this is not confirmed malware; the main concerns are transitive trust, supply-chain provenance, and autonomous repo-setting changes.