server-bootstrap

SUSPICIOUS: the skill's stated purpose matches its server-admin capabilities, so there is no clear malicious mismatch, but the missing bootstrap/deployer script contents create a verification gap for what actually runs as root. Security risk is medium due to remote root automation, passwordless sudo setup, and an unpinned third-party Docker image, not because of confirmed credential theft or exfiltration.