writing-agent-relay-workflows

SUSPICIOUS. The skill is broadly aligned with its stated purpose as a Relayflows workflow-authoring guide, and its install sources are mostly official npm/same-org resources rather than obvious malware delivery. However, it meaningfully expands an agent's operational footprint: it enables autonomous code changes, branch push/PR creation, Slack-mediated human interaction, and ingestion of untrusted provider events through an intermediary Relayfile layer. Combined with doc drift about the official package/CLI surface, this is better classified as a high-risk workflow automation skill rather than benign documentation.

The code is an automation workflow for converting a labeled GitHub issue into a pushed branch and pull request. It does not show clear malicious behavior or data theft. However, it has meaningful security risk: untrusted issue content is passed to a privileged coding agent, and environment-derived values are interpolated into shell commands. Review the assertion helpers, constrain and sandbox the agent, treat issue text as untrusted data, restrict repository permissions, and avoid staging unrelated files before use in production.