website-deploy

SUSPICIOUS: the overall behavior is largely consistent with a website deployment skill, but trust is reduced because it executes repo-controlled npm build scripts and an unseen bundled deploy.sh that likely uses AWS credentials. No clear malicious exfiltration or purpose mismatch is present, yet the opaque local script and script-execution footprint make this higher than benign.