setup-rhdh-skills

This module itself contains no clear malware or stealth indicators; it is an installer/orchestrator that executes external `npx skills add ...` commands. The main risk is supply-chain execution: if the catalog/pack URL/source or the provided plan is attacker-influenced, the executed `npx` command may fetch and install attacker-controlled third-party packages/skills. Structural validation reduces some malformed-plan risk but does not enforce trust boundaries for pack URLs/sources, and it returns unredacted command output from third-party tooling.