kf-g-github-operations-bot-workflow

SUSPICIOUS. The skill's GitHub-focused purpose is coherent and its documented data flow mostly aligns with official GitHub App practices, but the critical write path relies on custom local helper scripts that receive credentials and have no documented provenance, checksum, or release verification. That makes the capability proportionate to purpose yet still high-risk from a supply-chain and credential-forwarding perspective.