flag-publish

SUSPICIOUS: the stated purpose aligns with GrowthBook flag publishing, and the API/domain targets look legitimate, but the skill’s core operation is routed through an unseen bundled helper that receives GB_API_KEY. That credential-forwarding to unverifiable local code makes the trust footprint disproportionate enough to rate as high security risk even without evidence of confirmed malware.