GitHub PR comment fetcher

No strong indicators of intentional malware, exfiltration, or persistence are present in this module; it is primarily a GitHub PR review summarizer. The main security concern is the use of `execSync` with a shell-interpreted command string that includes user-controlled CLI input (repo owner/name), creating a potential command-injection risk depending on how the tool is invoked and how inputs are handled. Separately, the module emits Markdown containing untrusted GitHub content without sanitization; if that Markdown is later rendered as HTML by unsafe tooling, it can enable content injection/XSS in downstream systems. Overall: moderate security risk driven by the command-execution pattern and unsafe output handling for any non-CLI rendering pipeline.