merge-and-migrate

SUSPICIOUS: no clear malicious behavior or supply-chain attack is evident, but the skill grants itself authority to merge code and run production migrations without per-action approval. Its safeguards reduce operational risk but do not eliminate the consequences of autonomous deployment actions.