bmad-code-review

SUSPICIOUS: the stated purpose fits code review, and the only named external dependency (`uv`) appears officially sourced. The main risk is that this review skill executes project-controlled scripts and config-derived activation steps while ingesting broad untrusted repository content, creating a meaningful prompt-injection and arbitrary-command-execution surface disproportionate to a read-oriented review workflow.