yolo

SUSPICIOUS: the skill’s capabilities mostly match its stated deployment purpose and its main integrations appear official, so this is not confirmed malware. The primary concern is scope and autonomy: it can automatically perform production-affecting deployments after git push, and it chains into MCP/browser/testing workflows from a third-party skill publisher. Supply-chain risk is moderate, but the autonomous deployment behavior makes the overall skill high risk.