autonomous-orchestration

SUSPICIOUS: the skill is broadly aligned with its stated orchestration purpose and uses mostly official GitHub tooling, but it enables high-impact autonomous repository actions—especially automatic PR merges and public workflow updates—based on untrusted GitHub content and without per-action approval. This is better classified as a high-risk autonomous workflow skill than malware.