moshi-best-practices

SUSPICIOUS. The core behavior mostly matches a Moshi host-setup skill, but it carries non-trivial supply-chain and trust-expansion risk: two curl|sh installers, a paired daemon with persistent outbound connectivity, edits to multiple agent configs, and transitive installation of another skill. This looks more like a legitimate but high-trust integration guide than malware, yet the footprint is broader than a simple best-practices document and warrants caution.