bot-tasks

SUSPICIOUS: the skill’s GitHub automation purpose broadly matches its capabilities, and data flows stay within GitHub’s official API surface, but it depends on unverifiable local helper scripts and enables semi-autonomous repo changes plus cron-based persistence. The biggest concern is execution trust for ~/.claude/scripts and unattended action scope, not confirmed malicious exfiltration.