generate-release-cx

SUSPICIOUS. The skill is broadly coherent for release engineering, but its footprint is high-impact: it can publish releases, deploy as root to a VPS, and trigger public artifacts. Data flows appear aligned to the stated purpose and use mostly official tools, so this is not confirmed malicious; however, the scope and real-world action surface make it a medium-high risk operational skill.