pre-merge-review

SUSPICIOUS: The skill's overall behavior matches its stated purpose, but it has a medium-to-high security footprint for a review helper. The main concerns are sending full branch diffs to external AI services, relying on transitive reviewer-cli skills, and using permissive execution flags (`--dangerously-skip-permissions`, Bash, `--yolo`) while only enforcing read-only behavior by instruction. This looks like a coherent but high-trust orchestration skill rather than confirmed malware.