build

SUSPICIOUS. The skill is broadly aligned with its stated purpose as a software-build orchestrator, and it shows no clear credential harvesting, exfiltration, or remote-install behavior. However, its footprint is very large, it can autonomously modify and reset repository state, and it relies on many unreviewed internal sub-skills, so the overall risk is medium rather than benign.