GitHub PR Manager

• Analyzed: May 11, 2026, 6:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3de2302cc5f3b5974106883c81818ae8e03ec69bc716cc34255d038e096608d2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides automated GitHub PR management, which inherently requires high-risk capabilities such as handling GitHub Personal Access Tokens (PAT) with 'repo' and 'workflow' scopes and performing automated write operations like 'git push --force-with-lease'. While these actions are aligned with the stated purpose in SKILL.md and references/workflow.md, the automated execution of shell commands for credential login (gh auth login) and repository modification poses a significant security risk. No clear evidence of intentional malice or data exfiltration was found, but the broad permissions and automated lifecycle management meet the criteria for a suspicious classification.