gh-attach

SUSPICIOUS: the skill’s behavior mostly matches its GitHub-attachment purpose and routes data to GitHub, but it requires installing a personal third-party `gh` extension and letting it access a browser `user_session` credential with full-account power. Pinning, public source, and explicit warnings reduce concern, yet the credential-forwarding trust boundary keeps this above benign.