gsd-ship

SUSPICIOUS: the visible purpose is coherent with GitHub shipping tasks, and the known publisher/install path appears legitimate, but the skill’s effective behavior is hidden in an unprovided local workflow that has Bash and Write access and can perform autonomous GitHub actions. Risk is medium due to opaque delegated execution and possible third-party review hooks, not clear malware.