k-skill-setup

SUSPICIOUS: the skill's install path is same-org and registry-based, so not overtly malicious, but it materially defers behavior to remote instructions delivered at runtime through an npm CLI. That creates moderate supply-chain and reviewability risk disproportionate to a simple setup stub, though there is no clear credential harvesting or exfiltration in the provided content.