soia-pkm-bootstrap-vault-ima

SUSPICIOUS: the core vault-to-ima sync purpose is coherent and the data flow goes to the official ima service, with unusually strong privacy guardrails. The main concerns are transitive installation of other skills/plugins and the npx command granting wildcard agent permissions, which is broader than necessary for a setup guide.