setup-argo-skills

SUSPICIOUS. The skill's purpose mostly matches its bootstrap/setup behavior, but its footprint is broad: it installs and updates skills via unpinned `npx` commands, fetches raw GitHub assets, clones repo content, executes a script from that clone, and instructs installation of additional third-party skills. Data flow is largely consistent with project setup, and there is no clear credential harvesting or covert exfiltration, but the transitive trust chain and mutable install sources make it higher risk than a normal documentation-only skill.