radar-bootstrap

The skill is internally consistent and narrowly scoped for repository bootstrap, with no explicit credential harvesting, download-execute chain, or off-platform data flow. Risk comes mainly from the unspecified preinstalled `radar` binary: the exact upstream cannot be verified from the skill, and the generic tool name collides with multiple unrelated projects, so the dependency trust is ambiguous rather than clearly benign.