github-review

SUSPICIOUS. The skill's capabilities mostly match its stated GitHub PR review purpose and its network path points to official GitHub tooling, but it executes a repo-local unpublished script for validation/render/post and enables public posting under the user's identity. Approval gating makes it less dangerous than a covert or fully autonomous poster, yet the unverifiable local script and write/post authority keep overall risk above benign.