piper

SUSPICIOUS. The core GitHub bug-triage purpose is legitimate and the external CLI trust story is strong, but the skill’s actual footprint is broader than bug filing: it can autonomously process queued tasks, push/sync repos, publish a sanitized public fork from private content, and triage untrusted PRs with Bash and write access. No confirmed malware or credential theft is evident, but the combination of autonomous external actions and private-to-public data flow makes this a medium/high security risk skill.