solana-setup

SUSPICIOUS. The skill is purpose-aligned and does not harvest credentials, but its recommended installation method executes an unpinned remote script from a personal GitHub repository. The cargo path is lower risk; the curl|bash path creates medium-high supply-chain exposure without evidence of direct malicious behavior.