github-project-management

SUSPICIOUS: the GitHub management functionality is mostly aligned with the skill’s purpose, and `gh` usage is normal, but the skill delegates privileged project operations to third-party swarm packages executed via mutable `npx` commands from a different publisher. That creates medium supply-chain and delegated-access risk even without clear evidence of malware or explicit credential theft.