harvest-full-game

SUSPICIOUS: the skill’s game-building purpose is coherent, but its footprint is broader than a normal local build helper because it combines untrusted web research with code generation/execution and then performs autonomous public GitHub actions, including issue filing and PR merge. Tool provenance appears benign; the main risk is repo-impacting autonomy and prompt-injection exposure rather than malware.