deliver-task

SUSPICIOUS. The skill’s capabilities are largely coherent with a repository-local delivery orchestrator, and no credential exfiltration or third-party API routing is visible. The main issue is install/execution trust: it requires at least one unverifiable local CLI (`generate-task-contract`) and references another unverifiable tool (`deep-rules-review`) without source or release provenance in the provided evidence, which makes the workflow higher-risk even though it is not clearly malicious.