project-setup

BENIGN in purpose and data flow, but operationally high-impact: it autonomously performs real GitHub account/org actions using the user's existing credentials. No clear malware or exfiltration behavior is present, yet the subagent/autonomous repo administration design makes it a medium-high security risk skill.