Solana Squads Upgrade

SUSPICIOUS: The skill’s Solana/Squads capabilities align with its stated purpose, but it asks users to pass a keypair into externally executed GitHub Action code and has ambiguous action provenance due to owner/reference mismatch. That makes this a meaningful supply-chain and credential-forwarding risk, though not confirmed malware.

The workflow YAML contains no direct malicious code or obvious credential exfiltration logic, but it is a supply-chain risk hotspot: it delegates a privileged Solana program upgrade to a third-party GitHub Action while passing high-value secrets (RPC URL, multisig, keypair). Because the action is invoked via a tag rather than a pinned digest and its internals are not visible here, the key security concern is potential malicious or compromised action behavior leading to unauthorized upgrades and/or secret misuse.