deploy-app

SUSPICIOUS. The skill’s capabilities mostly match Kubernetes deployment orchestration, but its footprint is high-impact: it can deploy arbitrary third-party charts, modify repo state, push branches, and create PRs, while also referencing other skills and processing external research. No direct credential-harvesting or hidden exfiltration is evident, so this is not confirmed malware; the main concerns are supply-chain exposure from chart sources and autonomous real-world actions.