setup-openhands

SUSPICIOUS: the stated purpose matches repository setup, but the skill delegates trust to unverified helper skills and to repository-controlled CI/docs content, then converts that content into automatically executed scripts and workflows. No direct credential theft, exfiltration endpoint, or explicit malware behavior is present, but the transitive trust and repo-to-shell automation make the skill medium risk.