setup-repo

SUSPICIOUS: the skill’s core activities mostly fit repo onboarding for Socket-managed repos, but it has a broad and sensitive footprint: secret capture, shell persistence, browser native-host installation, and multi-tool installation. The biggest concerns are secret bridging into shell rc and the wildcard native messaging host origin, not confirmed exfiltration or overt malware.