setup-sandcastle

SUSPICIOUS: the skill’s purpose is coherent, but its footprint is high-risk. It installs and runs a third-party orchestration CLI, forwards an Anthropic API key to it, and enables autonomous issue-driven code changes, commits, and merges; noSandbox() and interactive passthrough further expand impact. Main concerns are supply-chain trust, credential forwarding, and autonomous execution against untrusted issue content.