gh-fix

SUSPICIOUS. The skill is purpose-aligned for GitHub issue fixing, and its main network/data flows stay within GitHub, but it grants broad autonomous write/merge authority and uses a token-bearing curl upload to an undocumented endpoint. The main concern is high-impact autonomous action scope, not confirmed credential theft or malware.