pr-sheriff

SUSPICIOUS: the stated purpose is advisory PR triage, but the documented workflow can merge PRs and create dispatch tasks, so its actual footprint is more powerful than advertised. No clear credential theft or third-party exfiltration is shown, but hidden logic in shared formulas and write-capable GitHub actions make this a medium-high risk skill.