ops-deploy

SUSPICIOUS. The core behavior matches the stated purpose and uses official AWS, GitHub, and Vercel interfaces, so the scanner's command-injection hits are mostly false positives. Risk remains moderate because the skill handles deployment credentials, can perform real-world deploy actions, and references an unverifiable local ops-infra helper whose provenance is not established in the skill.