raise-pr

SUSPICIOUS. The core git/GitHub capabilities and token flow are proportionate to raising a FlashList PR and use official GitHub tooling, but the skill explicitly instructs concealment of AI involvement and permits autonomous PR creation on CI. No malware or credential-exfiltration pattern is evident; the main risk is deceptive public action, not supply-chain abuse.