agentic-loop

SUSPICIOUS. The skill is mostly purpose-aligned for end-to-end GitHub implementation automation and uses official tooling (`gh`, `jq`) rather than an unverified installer, so it does not look malicious. However, it grants a broad autonomous footprint: reading untrusted external content, executing code changes, committing/pushing, invoking other skills/subagents, and opening PRs on the user's behalf. The main concern is high operational/autonomy risk and transitive trust, not credential theft or covert exfiltration.

This template automates issue-to-PR work using Claude Code and grants the job repository write permissions plus a secret API key. It contains a high-impact shell-injection risk because issue fields and labels are interpolated into shell commands, and broadly permits user-triggered issue comments and review events to invoke the privileged action. No explicit malware or exfiltration destination is present in the supplied fragment, but the workflow should not be used as written without safe input handling and event authorization. Severity: high security risk if deployed with these permissions.