land-and-deploy

SUSPICIOUS. The skill’s capabilities mostly match its stated purpose as a GitHub land-and-deploy workflow, and the external installer evidence points to same-org official gstack tooling rather than an unrelated payload. However, it has a broad operational footprint: many local helper binaries, eval-based helper output, optional remote installer execution, local telemetry, network access, and autonomous merge/deploy/revert actions. That is coherent for a release-engineering skill, but still medium-to-high security risk because the agent is empowered to perform irreversible production actions and relies on substantial external/local tool trust.