openharmony-ci

SUSPICIOUS. The skill’s purpose, permissions, and official OpenHarmony/DCP data flows are mostly coherent, but trust is weakened by its dependency on `oh-gc`, a non-OpenHarmony third-party CLI that may handle the user’s GitCode token. This is not confirmed malware, but it is a medium-risk workflow due to credential forwarding and unclear dependency provenance.