shunk031-github-cgd-identity

The skill's stated purpose and most capabilities are internally consistent: it scopes itself to one GitHub org, checks repository ownership, verifies permissions, and uses official GitHub tooling for write operations. The main risk is the unverifiable custom `setup-gh-cgd` bootstrap, which is required for new-machine authentication and effectively sits in the credential path; that makes this skill suspicious/high-risk from an install-trust and credential-forwarding perspective even though there is no clear evidence of malicious exfiltration to third-party endpoints.