llmquant-setup

SUSPICIOUS. The skill’s stated purpose mostly matches its capabilities, and the credential/data flow appears to stay within first-party LLMQuant services. The main issues are execution trust: a thin wrapper that defers to a mutable remote SETUP.md, transitive installation of additional skills, and possible unpinned npx execution. This is not confirmed malware, but it carries medium risk due to remote instruction loading and expanded trust scope.