pr-automate

SUSPICIOUS. The skill is mostly coherent with its stated GitHub PR automation purpose and uses official GitHub tooling, so supply-chain and exfiltration risk are low. The main concern is autonomous background operation that can edit PRs, post comments, poll for hours, and invoke other skills/subagents without per-action user review; that makes it higher-risk than a passive review helper, but not fundamentally malicious.