starlight-skills-deployment

SUSPICIOUS: the skill is mostly coherent as deployment/install documentation, but it explicitly enables transitive installation of external skills through an unpinned `npx` CLI workflow. There is no direct credential theft or exfiltration behavior, so this is not malicious, but the trust expansion to third-party skills makes it medium risk.