sgdk-release

SUSPICIOUS due to install/execution trust, not overt malware. The helper code is local-only, well-scoped, and does not exfiltrate data or request credentials, but the documented workflow depends on an unpinned third-party Docker image (`ewrogers/sgdk:latest`) without same-org verification, creating meaningful supply-chain risk for a release-preparation skill.