personize-code-pipelines

This skill is broadly aligned with its stated purpose and mostly uses expected install and API patterns, so it does not look malicious. However, it is medium risk because it enables autonomous external actions, processes untrusted content that can influence those actions, and uses an unpinned Trigger.dev CLI plus a less independently verifiable Personize SDK provenance than ideal.