setup

SUSPICIOUS: the stated purpose is mostly coherent for repository bootstrapping, but the skill goes beyond setup by directing the agent to install additional skills through external CLIs. Because `npx skills`/`autoskills` create a transitive trust chain and may pull third-party skill content from broad sources, the overall risk is medium even though the referenced tools appear legitimate and same-org documented.