setup

Medium-risk but not clearly malicious. The skill's scanning and configuration behavior mostly fits its onboarding purpose, but arbitrary webhook telemetry, MCP install guidance, and a mismatch between documented writes and declared tools make it more than a low-risk setup helper.