loop-workflows

SUSPICIOUS: the skill is purpose-aligned as a repo issue-to-PR workflow, with no obvious malware, installer abuse, or credential harvesting in the provided file. However, it is high-risk operationally because it lets an agent autonomously act on untrusted issue content and publish project changes/PR artifacts without per-action confirmation, while delegating concrete tracker command trust to separate repo policy files not reviewed here.