ship-roadmap

SUSPICIOUS. The skill's capabilities mostly match its roadmap-autopilot purpose, and there is no clear credential theft or exfiltration path. The main concerns are transitive skill installation and autonomous PR/merge actions, which expand trust and create meaningful operational risk even though the install source appears same-publisher and documented.