harvest-game

SUSPICIOUS: the core capabilities fit the stated purpose, and the tooling references are normal, but the skill is high-risk because it combines untrusted web research with local code execution and autonomous GitHub actions, including immediate PR merge. The main concern is unsafe automation scope and prompt-injection exposure, not confirmed malware.