kf-g-command-do-pr-rev-comment

SUSPICIOUS: the workflow purpose is coherent for PR review operations, and the GitHub write action fits the stated task, but the required local bot helper script is an unverifiable credentialed executable outside the reviewed skill. The main risk is trust in that opaque script and its credential/data handling, not the review-comment logic itself.