pr-review-bot

SUSPICIOUS. The core GitHub review workflow is purpose-aligned and uses official GitHub/Git tooling, but the skill is materially risky because it is designed for unattended public actions, consumes untrusted PR/comment content, and depends on an external pi subagent trust chain before posting under the user's account. No clear credential theft or malware behavior is shown, but the autonomous posting and indirect prompt-injection exposure make this higher than a benign documentation/workflow skill.

The script is intended to create a temporary review ledger and print review-agent instructions. It contains no evident malware or deliberate data theft. However, the user-controlled PR argument is incorporated into a filesystem path without sanitization, allowing path traversal or unintended file creation/overwrite if the script is run with a crafted argument and sufficient permissions. PR numbers should be restricted to digits or otherwise safely sanitized before constructing the path.