ship-ticket

SUSPICIOUS. The workflow purpose matches the capabilities, and the referenced skill/install sources appear to be legitimate same-project npm/GitHub documentation rather than obvious malware. Risk comes from transitive skill installation, mutable `@latest` dependency guidance, and autonomous code-host/tracker actions; there is no clear credential theft or malicious exfiltration pattern.