shipping-pr

SUSPICIOUS: The core GitHub/CI polling behavior is coherent and uses official tooling with low supply-chain concern, but the skill enables unattended repository actions and depends on transitive execution of other skills to create/fix/push PR changes. Risk is driven by autonomous code-change loops and inherited trust, not by malware-like exfiltration or suspicious install paths.