fdk-uat

SUSPICIOUS. The skill’s capabilities mostly match its UAT purpose, but its main execution model is a high-risk supply-chain pattern: piping a mutable GitHub raw bootstrap script directly into bash, with no pinning or verification and no concrete publisher identity to validate. Remote branch mutation and rollback are purposeful for release testing, not inherently malicious, and data flows stay on GitHub/Orca rather than unknown intermediaries. The dominant concern is install trust and destructive remote side effects, not confirmed malware.