writing-great-prs

SUSPICIOUS: the stated PR-writing purpose is plausible, but the skill’s actual footprint is broader than necessary because it mandates extra skill installation and a not-clearly-verified third-party CLI/package path. Data flow stays mostly within GitHub and local screenshot tooling, so this is not confirmed malware, but the supply-chain and transitive-trust risks are too high to call benign.