project-onboard

SUSPICIOUS. The core onboarding, local file reads, git diffing, and context generation are proportionate to the stated purpose and the `.config` findings look benign. The main risk is transitive trust: the skill encourages installing additional skills through a broad-source CLI, which extends the agent's permissions beyond onboarding and introduces supply-chain exposure.