local-github

SUSPICIOUS. The skill’s purpose and capabilities mostly align: local GitHub clone management and offline code reading are coherent, and data flows appear limited to GitHub. The main risk is execution trust in the undocumented local helper script, whose provenance and behavior are not verifiable from the provided content. No strong signs of malware or credential theft are present, but the unverifiable local executable keeps overall risk above benign.