setup-project

SUSPICIOUS: the stated purpose is coherent, but the skill’s main function is to install and execute other remote skills via an undocumented runtime path, then perform repo-affecting actions. No confirmed credential theft or malware appears, but the transitive install trust and autonomous repo operations make it medium-high risk.