craft-project-setup

SUSPICIOUS. The core file detection and config generation are consistent with a Craft CMS setup skill, but the footprint is broader than necessary: it seeds extensive future permissions, encourages companion-skill trust chains, inserts hidden adoption markers, and optionally runs an unpinned npx install. No direct credential theft or clear exfiltration is present, so this is not malware, but it carries meaningful security and trust risk.