pr-review-comments

The stated purpose is narrow and plausible, but the skill depends on an unverified `prc` CLI and implicitly hands it GitHub authentication. That combination is disproportionate to the task and creates a high supply-chain and credential-forwarding risk even without evidence of confirmed malicious intent.