build-and-release

SUSPICIOUS. The visible skill is small and coherent as a workflow wrapper, but it delegates all meaningful behavior to external `claude-mem` subskills and includes autonomous merge/release steps. There is no direct evidence of credential theft or malware in this file, yet the transitive trust chain and real-world repository actions make the skill medium risk until the referenced `build` and `release` skills are reviewed.