land-and-deploy

SUSPICIOUS. The skill is largely purpose-aligned for release engineering and mostly uses official GitHub tooling, but it has a broad operational footprint: merges and reverts code, hits production URLs, executes many local helper binaries, and evals helper output. I do not see clear credential theft or covert exfiltration, so this is not confirmed malware, but it is a high-impact operational skill with medium supply-chain trust concerns and high autonomy risk.