setup

SUSPICIOUS. The skill is mostly coherent with a GBrain setup assistant and uses largely official/same-publisher endpoints, so it is not clearly malicious. However, it combines an unpinned GitHub install path, broad filesystem discovery, persistent background service setup, and handling of powerful credentials (including optional Supabase service-role keys), which makes its footprint larger and riskier than a narrowly scoped setup skill.