gws-install

SUSPICIOUS: the core gws install/auth flow is mostly coherent and uses the project's documented npm distribution, but the skill directly handles OAuth client secrets, relies on a packaged native CLI, and performs transitive installation of a broad skill bundle through a separate `skills` toolchain. There is no clear exfiltration behavior, yet the additional trust chain and credential forwarding make the footprint broader than a minimal 'quick install' helper.