gpd-build-lifecycle

SUSPICIOUS: The skill’s release-management commands match its stated purpose, but it is built around a non-official third-party CLI that receives Google service-account credentials and can make production-impacting changes. No clear evidence of exfiltration or malware is present, yet the supply-chain and credential-forwarding footprint is disproportionate enough to treat as medium/high risk rather than benign.