implement-issue

SUSPICIOUS: the skill is mostly coherent with its stated GitHub-issue orchestration purpose, but it carries medium risk from transitive trust in installing another skill and from allowing autonomous public GitHub actions after an explicit user request. No strong evidence of credential theft, covert exfiltration, or malware; the main concerns are supply-chain and delegated-action scope.