github-workflow-automation

SUSPICIOUS: the skill’s capabilities generally match GitHub workflow automation, but its footprint is broader and riskier than a simple guide because it routes sensitive repo context and credentials through third-party `npx` tooling, includes alpha dependencies, and enables autonomous GitHub/deployment actions. No direct credential exfiltration or overtly malicious endpoint is shown, so this is not confirmed malware, but it carries meaningful supply-chain and automation risk.