release-checklist

SUSPICIOUS. The skill’s release-management capabilities mostly match its stated purpose and its external network flow is mainly direct to official GitHub tooling/APIs. The main risk is trust: it executes several repo-local PowerShell/Python scripts, including an installer-style script with ExecutionPolicy Bypass, and references a required sub-skill without verifiable provenance in the prompt. This is not confirmed malware or credential harvesting, but it is a medium-risk skill because local scripts and transitive skill dependencies could do more than the checklist claims.