mobile-publish

SUSPICIOUS: the skill’s purpose broadly matches mobile release automation, but its footprint is elevated by autonomous real-world release preparation, automatic repo/file modification, silent telemetry writes, and especially transitive delegation to four unreviewed skills. No direct malicious exfiltration or fake API routing is shown in the provided text, so this is not confirmed malware; the main risk is high-impact automation plus inherited trust from downstream skills.