gitworkflow

SUSPICIOUS. The skill’s Git/GitHub capabilities largely match its stated purpose and mostly use official tooling, but it has a major trust gap: a mandatory, unverifiable local `changelog` executable integrated into every commit/release flow. Combined with high-impact automated actions like PR merging, issue editing, and workflow deployment, this makes the skill high risk even without direct evidence of credential theft or malicious exfiltration.