github-release-management

[Skill Scanner] Installation of third-party script detected All findings: [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [HIGH] data_exfiltration: Credential file access detected (DE002) [AITech 8.2.3] BENIGN with elevated complexity and governance requirements: The release-management skill appears aligned with AI-swarm–driven orchestration and multi-repo deployment objectives. While there is no concrete evidence of malicious activity, the extensive use of alpha tooling, cross-repo access, and broad automation introduces operational and supply-chain risks. Key mitigations include strict secret management, provenance verification for external tooling, scoped permissions, and formal approvals for cross-repo changes. Overall, the approach is coherent but demands robust governance to prevent misconfigurations and credential leakage. LLM verification: This skill's documented capabilities and commands align with legitimate GitHub release automation. I found no evidence of obfuscated or intentionally malicious code, nor any third-party proxying of credentials. The primary security risks are expected for a release tool: it requires high-privilege GitHub/npm tokens and executes build/test scripts and installs dependencies (npm install). Treat tokens with least privilege, run on trusted CI agents, and review repository scripts/dependencies before