ensure-task-github-issue

The skill’s GitHub integration and credential use are aligned with its stated purpose, and no credential exfiltration or suspicious intermediary endpoint is evident. However, writing task-derived content through an unquoted heredoc creates a concrete command-injection risk, so the skill is suspicious despite the warning in its instructions.