ship

SUSPICIOUS. The skill is purpose-aligned and uses official GitHub/Git tooling with no obvious credential harvesting or third-party exfiltration, but it enables autonomous public repository actions and executes repo-controlled test commands before merging. Main risk is operational autonomy and untrusted local code execution, not malware.