fable-tend

SUSPICIOUS: the core GitHub PR maintenance behavior is purpose-aligned and data stays with GitHub, but the skill autonomously performs approval/comment actions and depends on transitive loaded skills plus an unseen local helper script. The scanner's backtick findings are documentation artifacts, not active command injection.

SUSPICIOUS. The skill's capabilities broadly match its stated purpose as a full Tend installer, so it is not fundamentally deceptive, but its footprint is very high: it provisions multiple credentials, reads/stores raw bot tokens, modifies branch protection and environments, and runs mutable latest external tooling. Data flows mostly go to official GitHub/Anthropic/OpenAI endpoints or same-org Tend infrastructure, which argues against outright malware, but the combination of broad admin actions and credential forwarding makes it higher-risk than a typical documentation/install skill.

Likely benign workflow skill with meaningful operational risk. Its capabilities largely fit its purpose—reviewing CI outcomes and filing fixes on tend—but it combines untrusted-content ingestion, shell access, evidence persistence, and autonomous GitHub write actions. No clear malware or hidden exfiltration is present; the main concerns are prompt-injection exposure, transitive trust in referenced skills/bundled scripts, and autonomous PR/issue creation.

SUSPICIOUS. The core behavior is coherent with a PR-review skill and mainly uses official GitHub tooling, so this is not confirmed malware. Risk is elevated because the skill processes untrusted PR content, can take autonomous repository actions including posting and pushing, and depends on a transitive skill plus local helper-script execution via `uv`.

The visible fragment appears to implement a GitHub discussion-response bot and reaction cleanup, not overt malware. However, it passes user-controlled discussion content to an agent that may be able to modify and push repository changes and is configured with secrets. This presents a meaningful prompt-injection and credential-use risk; the agent action's safeguards and workflow permissions are not visible in this excerpt.

The fragment is not malware evidence on its own, but it does instruct an agent to bypass a harness write restriction and then publish a branch and PR. Treat execution as a privileged repository modification and verify authorization and the resulting diff before allowing it. The workflow's separate-PR and no-merge constraints reduce, but do not eliminate, the risk.

The fragment appears intended to automate pull-request reviews and manage a reaction. It contains no direct evidence of malware, but the privileged pull_request_target context, write permissions, secrets passed to a third-party action, and tag-based action reference create meaningful supply-chain and untrusted-PR-content risks. Assessment of the action's internal behavior requires reviewing its source.