github-code-review

SUSPICIOUS: overall coherent with a GitHub PR review skill and uses official GitHub endpoints, so there is no strong malware signal. Risk is elevated by raw credential-file scraping, an unverified local helper script reference, and the ability to autonomously post approvals/comments; this is a medium-risk workflow skill rather than a benign read-only guide.