create-harness

SUSPICIOUS: the stated purpose is coherent, but the skill delegates all meaningful work to an external npx package and the referenced package name does not cleanly match the currently documented official CLI (`metaharness`). That makes install trust the main issue; no clear credential theft or malicious data exfiltration is shown.