drive

SUSPICIOUS: the skill's purpose and capabilities are mostly aligned for PR supervision, and the bro dependency appears to come from the expected npm publisher path. However, it grants a high-impact autonomous workflow surface: detached supervision, fixer spawning, rebases, force-pushes, and merges, all mediated by an external CLI whose detailed behavior is outside the skill file. This looks more like a risky orchestration skill than malware.