projectsetup

SUSPICIOUS: the core purpose is coherent, but the skill expands trust to unseen local scripts and an unseen MCP registry, then may persist plaintext secrets into project config files and enable arbitrary MCP commands/endpoints. This is not fundamentally incompatible with project setup, but the unverifiable MCP/script provenance and credential-handling make the setup higher risk than a simple template copier.