process-prs

SUSPICIOUS: the skill’s core behavior mostly matches its stated GitHub PR automation purpose, and its primary data flow stays within GitHub using the official `gh` CLI. Risk comes from autonomous write actions on repositories and branches, recurring `/loop` composition, and execution of local git/review workflows on PR content; the third-party `git-hunk` dependency is public and source-visible, so it raises trust risk but not to the level of a black-box credential-stealing installer.