knowledge-patch-setup

SUSPICIOUS: the skill’s stated purpose matches its behavior, and there is no clear credential theft or unrelated access. However, it performs transitive skill installation from remote repository content, allows source override via KP_PUBLIC_REPO/--public-repo, and relies on an unseen helper script for the actual fetch/install logic, so the trust boundary is broader than a simple local setup helper.