init-onecli

SUSPICIOUS. The skill is broadly coherent with its stated purpose—installing OneCLI and migrating credentials into a vault—but it has a large security footprint: remote `curl|sh` installation, reading raw `.env` secrets, forwarding them into vendor software, editing shell startup files, and restarting services. This looks more like a high-trust setup/migration skill than outright malware, but it should only be used when the user explicitly wants OneCLI and accepts the installer and credential migration risks.