fdk-uat

SUSPICIOUS: the skill’s capabilities broadly fit release acceptance testing, but its trust model is risky because the main action is executing a mutable raw GitHub bootstrap script via pipe-to-shell, then performing high-impact git remote changes. No clear credential harvesting or off-purpose exfiltration is shown, and data flows stay mainly within GitHub/Orca, but the install path and remote-write scope are stronger than ideal for a testing skill.