morning-pr-review

The skill is purpose-consistent: it reviews code/tickets and prepares a morning brief plus weekly paper. The main risk is not hidden theft but autonomous outbound actions and data export through the local screenless Worker, combined with disabled sandbox background execution and ingestion of untrusted PR/ticket content. Overall this is better classified as suspicious/high-vulnerability than malicious.