cicd-integration

SUSPICIOUS: the skill’s stated CI/CD capabilities mostly fit its purpose, and the flagged shell/credential patterns are primarily documentation context. The main concern is install trust: the referenced GitHub skill repo was not verifiable, the publisher appears to be a personal fork, and the skill grants broad deployment-oriented actions with user-supplied endpoints such as Jenkins. No direct credential theft or malicious exfiltration is evident from the supplied content.