clawsweeper

SUSPICIOUS: the skill is broadly aligned with a GitHub maintenance bot, but its footprint is high-risk because it enables autonomous repository mutations and optional merges, uses sensitive GitHub App credentials, and may execute workflows on third-party Blacksmith runners. This looks like a legitimate ops skill with significant trust and governance risk rather than confirmed malware.