ship

SUSPICIOUS. The workflow largely matches its stated shipping purpose, but it is high-impact: it can autonomously commit, push, create PRs, reply to review systems, log telemetry through opaque helper binaries, and auto-execute another skill. Same-suite provenance reduces malware concern, yet the action scope and transitive trust make the skill high security risk for an agent.