init-project

SUSPICIOUS. The core project-scaffolding behavior is coherent and mostly uses official tooling, but the skill expands scope by installing another skill set transitively and does so through a mutable `bunx skills@latest` path. That trust-chain expansion is disproportionate to simple project initialization and is the main security concern; no direct credential theft or malicious exfiltration is evident.