pr-triage

SUSPICIOUS: the skill’s purpose and most capabilities are coherent for GitHub PR triage, and its use of official `gh`, `git`, and Dart commands is proportionate. The main issue is trust: it requires an unverifiable `kscripts pr-triage` executable with no provenance or install source provided, which forces a high security-risk classification; the PR-content prompt-injection surface is real but expected for this workflow and not by itself malicious.