ship

SUSPICIOUS. The skill’s capabilities largely match its stated purpose as an end-to-end release tool, and its network endpoints are official and proportionate. However, default autonomous execution of push/release/publish actions creates meaningful security and operational risk, so it should not be classified as benign even without signs of credential theft or malicious exfiltration.