orca-onboard

SUSPICIOUS: the core repo-onboarding behavior is broadly aligned with the stated purpose, but the skill’s footprint is too expansive for a documentation pipeline. It bootstraps external tooling, installs another skill, sends code content through a third-party CLI/service, and includes an unrelated sync-and-push step back to the publisher repo. The push step and transitive installation are the strongest proportionality problems; the raw GitHub bootstrap/curl|bash path raises supply-chain risk further. Not confirmed malware, but medium-high security risk.