vector-db-init

SUSPICIOUS. The skill's capabilities largely match its stated setup purpose and it does not request secrets or route data to odd endpoints, but its trust model is weakened by unpinned package installs, a local init script of unknown contents, and especially the optional transitive installation of another skill/tool from an unpinned GitHub Git URL on a personal account. This looks more like a risky developer workflow skill than confirmed malicious content.