qa

SUSPICIOUS: The skill is mostly aligned with its stated QA purpose and uses legitimate GitHub tooling, but it enables autonomous external actions by filing issues without per-issue confirmation and references a repo-local browser wrapper whose behavior is not visible here. Risk is medium from autonomy and unverifiable local-script execution, not from clear malware or credential theft.