repo-config

SUSPICIOUS: The skill's stated purpose is coherent, but its execution relies on an unverifiable gh-manager CLI that performs repo writes and PR creation without clear publisher linkage, version pinning, or release verification. No direct credential harvesting or third-party exfiltration is shown, so this is high supply-chain risk rather than confirmed malware.