ticket-autopilot

SUSPICIOUS. The skill is largely coherent with its stated ticket-orchestration purpose and mostly uses expected local scripts plus GitHub/Git flows, so it is not malware. However, it has a high-impact operational footprint: it can publish PRs, merge, create issues, manipulate worktrees, and invoke the separately installed Pi CLI for local package synchronization. Those autonomous and delegated actions make it medium-risk even though the documented authority gates and same-org Pi provenance reduce concern.