new-skill

SUSPICIOUS: the core scaffolding workflow is mostly coherent and uses local same-repo scripts, but the skill also instructs transitive installation of another skill set through a third-party CLI using an unpinned `#main` GitHub target. That extra trust chain is not necessary for scaffolding and materially raises supply-chain risk even without clear evidence of malware or exfiltration.