gh-fix

SUSPICIOUS. The skill’s broad GitHub automation is mostly aligned with its stated purpose, and its install path is same-org and verifiable. The main risks are disproportionate autonomy to publish/merge on the user’s behalf and token reuse through a direct undocumented GitHub upload endpoint instead of the documented attachment flow.