github-release-management

SUSPICIOUS. The skill’s capabilities largely match GitHub release management, and most network destinations are official service endpoints. The main risk is trust expansion: extensive use of unpinned `npx claude-flow`/`@alpha` in workflows that also possess publish tokens and release permissions, plus broad autonomous publishing/deployment actions. This looks coherent for release automation but carries meaningful supply-chain and credential-forwarding risk.