package-n8n-green

SUSPICIOUS. The skill’s capabilities broadly match its stated infrastructure purpose, and the SSH-based remote actions are proportionate for provisioning and acceptance testing. The main risk is transitive trust: installing/updating a GitHub-hosted skill via `npx skills add` without an immutable pin leaves behavior subject to upstream changes, and the skill also depends on a separate same-org Neon package/repo. Credentials requested are extensive but mostly proportional to the deployment task, with data flowing to expected provider endpoints rather than unrelated third-party services.