scaffold-project

SUSPICIOUS: the core scaffolding behavior is coherent, but the skill adds disproportionate trust and data-flow risk through arbitrary telemetry endpoints, mutable npx installs, and transitive installation of other skills from URLs. Not confirmed malware, but high security risk for an AI agent skill.