env-setup

SUSPICIOUS: the skill’s core actions fit environment setup, but its footprint is broad for an autonomous agent. Main risks are unreviewed execution of repository scripts, package-install supply chain exposure, local file modification, and no confirmation before impactful actions; there is no strong evidence of credential theft or external exfiltration.