gsd-ship

SUSPICIOUS: the wrapper's stated purpose aligns with developer workflow automation, and the same-org local dependency appears legitimate, but the actual behavior is hidden in an unreviewed local workflow file with Bash/Write permissions and potential public VCS actions. Risk is moderate because the skill can take external actions and delegate to unseen shell logic.