gds-code-review

SUSPICIOUS: the stated purpose is code review, but the skill also executes project-controlled activation steps and a project-local resolver script, giving the repository significant influence over agent behavior. No clear credential theft, remote installer, or third-party exfiltration appears, but execution trust and scope are broader than necessary for a review-only skill.