release

SUSPICIOUS: the skill is purpose-aligned and uses mostly normal project/release tooling, but it grants an AI agent authority to carry out public release and distribution actions after a merge using local signing material. That makes it high-impact operational automation rather than malware; the main risk is autonomous real-world publishing, not credential theft or covert exfiltration.