screening-a-low-trust-contribution

Use when a PR or issue from an unknown or low-trust author needs its diff and metadata screened for contribution-level threats -- workflow-file edits, edits to existing governance/instruction files, hook/script and install-time-script changes (including a new dependency's own lifecycle scripts), dependency additions, typosquat patterns, unreviewable content, and instruction-bearing filenames or content; distinct from untrusted-input-triage, which triages a single piece of externally-authored text; this inspects a diff and its metadata, and requires the literal diff -- fetched via a platform-integrated tool call, never a hand-invoked CLI -- not a paraphrase of it.