co-founder-setup

SUSPICIOUS. The skill’s stated purpose and file-writing behavior are coherent and user-visible, and it does not request credentials or route data to external services. However, it requires execution of a bundled graph-audit program whose contents and provenance are not verifiable from the provided materials, creating a high supply-chain trust risk disproportionate to an otherwise benign setup workflow.