release

SUSPICIOUS: The skill’s purpose and capabilities mostly align with a maintainer release workflow, and data flows go to official services rather than hidden intermediaries. However, it is high-trust automation: it retrieves secrets from 1Password, creates an npm token with bypassed 2FA, forwards that token into project scripts, and can perform public package/template releases. This is coherent for a release skill but materially risky and should only be used in a tightly trusted maintainer environment.