gpd-cli-usage

SUSPICIOUS: the skill’s purpose and guidance are coherent, and its safety advice is generally sound, but it centers on a non-official third-party CLI that handles a sensitive Google service account key. With no direct install steps in the skill and no evidence of overt exfiltration, this is not malicious, but it carries medium risk from credential forwarding and supply-chain trust.