yds-setup

SUSPICIOUS. The skill's capabilities mostly match its stated setup purpose and it emphasizes user approval, but it expands trust by executing a remote installer and by installing another skill transitively. Those are proportionate to a harness/bootstrapper in concept, yet still medium risk because they introduce external code and inherited permissions beyond simple local file templating.