document-release

SUSPICIOUS: the core doc-update behavior is legitimate, but this skill's actual footprint is much broader than its stated purpose. It executes a large same-org helper toolchain, writes local analytics, can sync artifacts, inject routing rules, and make git commits; those are not proportionate to a simple post-ship documentation updater. I do not see clear credential theft or malicious exfiltration, but the install/runtime trust and scope expansion make it medium risk.