version-bump

SUSPICIOUS. The workflow largely matches its stated release-automation purpose and uses official GitHub/npm flows, but it authorizes the agent to perform autonomous real-world publishing and to operate directly on maintainer secret files (~/.npmrc and a local .env-backed notifier). That scope is high-impact for a skill, and the local Discord notification script is not independently verifiable. This is not confirmed malware, but it is a high-trust release skill with meaningful credential-handling and autonomy risk.