ci-monitoring

SUSPICIOUS. The core CI-monitoring workflow is coherent and uses official GitHub/local tooling with no third-party installer or proxy data flow, so supply-chain risk is low. However, the skill crosses into high-risk autonomous action by requiring immediate PR merge and continued work without explicit user approval, which is disproportionate for an agent skill operating with GitHub write privileges.