manager

SUSPICIOUS. The core GitHub automation is purpose-aligned and uses official GitHub tooling/data paths, so this is not confirmed malware. Risk comes from broad autonomous write authority, transitive references to unreviewed companion skills, and prompt-injection exposure from reading external issue/project content while also being allowed to execute commands and modify GitHub/local planning state.