GitHub Auto Reply

This skill mostly gives a GitHub Actions workflow to auto-comment on issues — it is coherent with its basic purpose but contains two red flags you should address before use: 1) The README/description promises 'AI analysis' and fast 'AI' replies, but the provided workflow uses only simple heuristics (labels, substring checks) and static templates. If you expect real AI-driven responses you should verify which AI service will run, what credentials it needs, and where model calls occur. As-is there are no AI calls. 2) The instructions recommend enabling 'Allow all actions' in repository settings. That is broader than necessary and increases risk: it allows any third-party GitHub Action to run in your repo. Instead, prefer a least-privilege configuration: allow only specific actions or use the official actions/github-script and ensure workflow permissions restrict GITHUB_TOKEN to the minimum (issues: write). Also explicitly set workflow 'permissions' (e.g., issues: write) so you know what's being granted. Additional practical steps: - Replace placeholder contact@example.com with a valid address you control. - Test the workflow in a non-production/test repository first. - Review the exact templates the workflow will post to avoid leaking internal info. - If you want true AI-based replies, demand explicit code/instructions showing API calls, and review what credentials (API keys/PATs) are required before installing. Given the marketing/implementation mismatch and the insecure permission recommendation, treat this skill as suspicious until those issues are resolved.