starter-packs

SUSPICIOUS: the core project-bootstrap behavior is coherent and mostly benign, but the undocumented install.sh <language> path is an unverifiable installer and the required loading of other unspecified skills adds transitive trust risk. No direct credential harvesting or exfiltration is evident.