github

SUSPICIOUS. The skill's behavior is largely coherent with a local GitHub emulator and there is no clear credential theft, hidden execution, or malicious data routing. The main concern is install trust: an unpinned `npx emulate` path with publisher/provenance ambiguity between vercel-labs documentation and the npm package actually resolved at runtime. Webhook POSTs and generated private keys are expected for this purpose but require careful local handling.