to-prd

SUSPICIOUS: the core behavior is coherent for a PRD-to-issue-tracker skill, but it includes an unverifiable project-specific setup command and an external publishing action with unspecified auth/endpoints. No clear malware or credential-stealing behavior is shown, yet the install trust and outbound data/publication path are not transparent enough to classify as benign.