workflows-install

SUSPICIOUS: the skill is mostly coherent with its stated Zapier Workflows setup purpose and uses official Zapier/npm flows for the SDK CLI, but it materially broadens trust by auto-installing six additional skills through a third-party `skills` CLI. This is not confirmed malicious, but the transitive skill installation and mutable `@latest`/remote skill fetches make it higher risk than a simple vendor CLI installer.