pypi-doppler

SUSPICIOUS: The skill is mostly coherent for local PyPI publishing and uses official tools/endpoints, so it does not look overtly malicious. However, it enables autonomous real-world publishing, forwards PyPI credentials through a third-party secrets manager and local env vars, and includes self-modifying instructions, making it higher risk than a normal documentation-only skill.