scaffold-strict-rust-projects

SUSPICIOUS. The skill's capabilities fit its stated Rust scaffolding purpose, and most commands are normal developer-tool usage. The main risk is supply-chain trust: it permits execution of template-defined hook commands from an unverified third-party GitHub template repo, which is a meaningful install/execution risk even though the skill tells the agent to show the hook first. No clear credential theft, exfiltration, stealth, or malicious misalignment is evident.