pr-photo-roll

SUSPICIOUS: the purpose is coherent, but the skill’s real footprint depends on unseen local pnpm scripts that receive a write-capable token and can post externally. The main concern is execution trust and credential forwarding to opaque repo code, not overtly malicious behavior.