release

SUSPICIOUS: The workflow is coherent for a maintainer release skill and uses official services/CLIs, so there is no strong evidence of malware or deceptive exfiltration. However, it has high-impact autonomous publishing behavior and extensive credential handling/forwarding, including creating a bypass-2FA npm token and storing it temporarily, which makes the skill medium-high risk even though purpose alignment is reasonable.