gh-issues

SUSPICIOUS: The core GitHub automation behavior matches the stated purpose and uses official GitHub endpoints, so this is not confirmed malware. However, it is high-impact automation: it reads raw local tokens, forwards them into git/curl subprocesses, embeds tokens into remote URLs, can autonomously push code and post PR/review replies, and can send summaries to Telegram. The footprint is broadly coherent but more powerful and invasive than a minimal issue-fetching skill.