gm-orchestrate

SUSPICIOUS. The skill is internally coherent and uses official GitHub endpoints rather than odd proxies, so it does not look like credential theft or malware. However, it grants an AI agent broad autonomous authority to edit code, push to main, dispatch workflows, and keep acting with limited user checkpoints, which makes it a high-impact orchestration skill that should be treated as operationally risky.