upstream-fork-sync

SUSPICIOUS: the skill’s core purpose is coherent, and GitHub token use is legitimate, but it sets up autonomous force-push/deploy behavior and routes an automation API key to an externally supplied endpoint that is not clearly verified in public docs. Main risk is underdocumented endpoint trust plus high-impact unattended actions, not confirmed malware.