yds-setup

SUSPICIOUS: the skill's stated purpose mostly matches its behavior, but its footprint includes two notable trust expansions that are disproportionate for a setup helper: an unpinned raw GitHub `curl|bash` installer and transitive wildcard skill installation via `npx skills add`. I see no clear credential harvesting or covert exfiltration, so this is not confirmed malware, but it is a medium-high security risk due to supply-chain and inherited-permission exposure.