getting-started

SUSPICIOUS: The skill’s core purpose is coherent, and its auth/API flows appear to target the publisher’s own service, but it combines a pipe-to-shell installer with incomplete provenance verification and transitive installation of additional skills. This looks more like medium-risk onboarding for a hosted CLI ecosystem than confirmed malware.