secure-ship

SUSPICIOUS. The skill’s purpose is coherent, but it is high-risk because it enables autonomous offensive testing and code-shipping actions, delegates to unseen local skills, and writes telemetry under ~/.claude/projects without explicit user confirmation. This looks more like a powerful vulnerable orchestration skill than confirmed malware.