pr-test

SUSPICIOUS. The skill is broadly aligned with PR E2E testing, but its footprint is high: it copies secret .env files, uses test credentials and local OAuth material, mutates Redis/DB state, uploads screenshots to GitHub, and can autonomously post reviews and push fixes. Install sources are mostly official/attributable, so this is not confirmed malware, but the credential handling and autonomous GitHub actions make it a high-risk workflow skill that should only run in a tightly trusted environment.