pr-explainer

SUSPICIOUS: the core behavior is mostly benign and aligned with PR summarization, but the explicit instruction to load an unpinned `artifact-explainer` skill introduces transitive trust without provenance. No direct malware, credential theft, or exfiltration endpoint is shown in this skill itself.