bootstrap

SUSPICIOUS: this snippet is minimal and shows no direct exfiltration, installer, or credential theft, but it is a thin wrapper that delegates all real behavior to unseen `bootstrap.md` and an unseen `/promptkit` skill. That transitive trust and lack of verifiable publisher/install context make the skill's actual footprint impossible to validate from this file alone, so risk is medium despite low evidence of confirmed malware.