vscode-openvsx-extension-publish

The skill's footprint is coherent with its stated purpose: it describes acceptable, standard tooling and workflows for publishing VSCode extensions to official marketplaces, plus CI/CD automation with GitHub Actions. While credentials (PATs and tokens) are involved, their handling via secrets is appropriate for legitimate publishing tasks. No evidence of credential exfiltration, unverifiable binaries, or malicious activity. The main caution is ensuring secure handling of tokens in CI logs and avoiding any hard-coded credentials in scripts.