fix-github-issue

SUSPICIOUS: the core workflow is coherent for fixing a GitHub issue, but it relies on unprovided external skills and permits autonomous PR creation on CI. No clear credential theft or exfiltration is shown, yet the transitive skill trust and real-world action scope make this a medium-risk agent skill.