review-pr

SUSPICIOUS. The skill’s GitHub capabilities align with PR review/merge automation and its data flows stay on expected GitHub paths, so it does not look like credential theft or overt malware. However, it is high risk because it grants an AI agent fully autonomous authority to modify code, push commits, post replies, resolve/hide comments, and merge PRs without user confirmation.