canonical-project-skills-layout

SUSPICIOUS: the skill’s core behavior—normalizing local repo layout and guide files—is coherent and locally scoped, with no evident credential access or exfiltration. The main risk is install trust: it directs use of an unpinned third-party CLI to install a personal GitHub skill repo, creating a transitive trust chain disproportionate to a layout-migration helper.