pocket-init

SUSPICIOUS. The skill’s stated purpose is coherent with its local file-reading and merge-safe writing behavior, but its core Education path depends on unpinned `npx -y` execution of a third-party package from a personal publisher. That creates a meaningful supply-chain risk even without evidence of malicious intent or clear exfiltration.