gh-issues

SUSPICIOUS: purpose and GitHub data flows are broadly coherent, but the skill is high-risk because it reads raw credentials from config, forwards them to git/curl, allows autonomous code pushes/PRs/replies, and processes untrusted issue/review content with execution-capable sub-agents. Not confirmed malware, but disproportionate automation and credential handling make it a vulnerable skill.