skill-ship

SUSPICIOUS: the skill’s local file, archive, and git-tag actions fit its shipping purpose, but it mandates execution of a separately installed external orchestration script that may route project code to outside AI providers, and that dependency is not pinned or verified by the skill. This is not confirmed malware, but the install/execution trust and partially opaque data flow make it medium risk.