soia-pkm-bootstrap-vault-base

The skill is not confirmed malicious, but it is security-relevant and somewhat suspicious because a local vault-bootstrap skill also installs other skills from unpinned remote repos and requests wildcard permissions. The local file-creation purpose is coherent, yet the transitive skill installation path and broad permission scope make the overall risk medium.