game-pipeline

SUSPICIOUS. The skill is broadly coherent for game development and does not request disproportionate credentials or route secrets to third-party endpoints, so it is not malicious on its face. Risk comes from broad Bash/Write authority, public deploy capability, transitive skill delegation, and unpinned execution of external CLIs—especially third-party gh-pages via npx.