electron

SUSPICIOUS. The skill’s main capabilities do match its stated Electron build/deploy purpose, and its use of electron-builder via npm appears legitimate. The concern is scope and operational trust: it hardcodes a production VPS/IP, assumes root-level deployment access, invokes an opaque local deploy script, runs deployment in the background, and performs real-world release actions including git push. This is coherent for a private project release skill, but it is high-impact and should only run in a tightly trusted environment with explicit user approval per deploy.