code-review

SUSPICIOUS: The skill’s behavior largely matches its stated purpose, but it sends source code to third-party services whose ownership and policies are not clearly verifiable, and it promotes full-repo scanning through a separate free-hosted domain. This is more a confidentiality and trust-boundary risk than confirmed malware.