golang-project-starter

SUSPICIOUS. The core project-bootstrap behavior is coherent and mostly benign, and the Docker/go tool references are proportionate to the purpose. The main risk is the explicit installation of third-party repo-local skills via `npx skills add` from a mutable external repo, which creates transitive trust and supply-chain exposure even though the mechanism is officially documented.