work-on-issues

SUSPICIOUS. The core issue-management purpose is legitimate and its tracker CLI/data flows are mostly coherent, but the skill is high risk because it grants autonomous merge/close actions and unnecessarily spreads .env secrets into sub-agent worktrees. No confirmed credential theft or malicious installer is present, but the scope is broader and more dangerous than a typical issue-implementation helper.