open-code-review

SUSPICIOUS. The core capability is coherent: a code-review skill invoking Alibaba's official OCR CLI with expected code/LLM data flows. Main risk comes from supply-chain and trust-extension behavior: curl-to-shell from raw GitHub, unpinned command-file downloads, and especially transitive installation of another skill from a third-party GitHub repo unrelated to Alibaba. No strong evidence of credential theft, covert exfiltration, or confirmed malware.