ship-playbook

This skill is coherent with its stated purpose as an autonomous software-delivery orchestrator: it reads repo state, launches a workflow, updates status files, and reports findings. The main risks are proportional but non-trivial: broad code-modifying autonomy, optional delegation to external harnesses, and explicit transitive installation of more skills/agents. I do not see evidence of credential harvesting, covert exfiltration, malicious pre-execution commands, or hidden data routing, so this is better classified as suspicious/high-risk workflow automation rather than malware.

This code is an AI-agent repository build and review orchestrator, not an evident data-stealing or remote-control payload. Its main security concerns are indirect shell-command injection potential from unescaped configuration/plan values and destructive Git cleanup that can force-remove unrelated worktrees under `.claude/worktrees/` or abort a user's in-progress merge. It references `.env` but explicitly instructs agents not to disclose secret values, and contains no suspicious domains, IP addresses, or direct exfiltration logic. Overall severity is moderate operational risk; validate inputs and restrict cleanup to worktrees demonstrably owned by this workflow.