cloud

SUSPICIOUS: The core Shiplight API and data flows are mostly aligned with the stated cloud-sync purpose, but the daily `npx skills@latest update` step introduces a notable supply-chain risk because it executes an unpinned package whose Shiplight ownership is not verified here. Secret handling is broadly proportional, though direct `.env` writing and optional storage-state upload raise moderate exposure concerns.