publish-harness

SUSPICIOUS: the overall workflow matches a publishing skill, but its footprint is broader than a minimal npm release helper because it performs public release actions, executes arbitrary repo scripts, and routes signing/secret handling through a third-party `harness` CLI. No confirmed malicious behavior is shown, but credential forwarding and autonomous publish capability make this medium risk.