build-phases

SUSPICIOUS: the skill’s capabilities mostly fit its build-orchestration purpose, but it grants a high-autonomy agent the ability to execute commands, modify code, commit changes, and post GitHub comments continuously from issue/task content. There is no clear credential harvesting or exfiltration, so this is not malware, but the operational and prompt-injection risk is medium-high.