agent-project-board-sync

SUSPICIOUS: the core GitHub Projects automation purpose matches most capabilities, and the gh-based data flow is generally coherent. The main risk is repeated execution of unpinned third-party `npx ruv-swarm` commands plus optional outbound webhook syncing, which expands trust beyond GitHub and npm without strong version pinning or provenance controls.