github-workflow-automation

SUSPICIOUS: the skill is broadly aligned with GitHub workflow automation and uses mostly official tooling, so it is not fundamentally malicious. However, it grants substantial autonomous repository control, sends repository content to a third-party AI API, and processes untrusted GitHub content in workflows that can comment, push, and deploy; combined with non-SHA-pinned actions, this makes the overall risk medium rather than benign.