setup-deploy

SUSPICIOUS. The core deploy-detection behavior is legitimate, but this skill’s actual footprint is much broader than its stated purpose: telemetry, artifacts sync, gbrain integration, routing injection, vendoring migration, git commits, and dynamic helper execution. Data mostly stays local or follows same-project tooling, so this is not confirmed malware, but the scope is disproportionate for a deployment-config skill and creates meaningful execution-trust risk.