initialization

SUSPICIOUS: the stated purpose matches project initialization, but the skill’s real footprint depends on opaque local scripts and transitive loading of other skills, especially for MCP and hook setup. No direct credential theft or malicious exfiltration is visible, yet install trust is only partially verifiable, so this is medium risk rather than benign.