harvest

SUSPICIOUS: the skill’s purpose is coherent for repository maintenance, but its footprint is high-risk because it combines untrusted external inputs with code execution and autonomous GitHub actions, including immediate PR merge behavior. No confirmed malware or credential theft is evident, but the operational and prompt-injection risks are substantial.