rust-node-ci

SUSPICIOUS. The CI/CD guidance itself is benign and well-scoped, but the skill includes a transitive skill installation step to a different publisher than the one claimed in metadata. The main risk is trust-chain expansion and provenance mismatch, not direct malware or credential theft.