issue-driven-development

SUSPICIOUS. The skill’s GitHub/project-board capabilities mostly match its stated purpose, and it uses official GitHub tooling rather than suspicious installers or proxy endpoints. However, it combines ingestion of untrusted GitHub comments with write/exec capabilities and directs the agent to autonomously merge PRs and continue to the next issue, creating meaningful workflow and prompt-injection risk disproportionate to a normal guidance-only skill.