private-github-search

SUSPICIOUS: The skill's purpose is coherent and official tools like gh fit the use case, but it asks the agent to execute an unseen local sync script with authenticated access to private repositories and to create a large local mirror of sensitive code. The main concern is execution trust and unverifiable script behavior, not clear evidence of malicious exfiltration.