4-step-program

SUSPICIOUS. The core GitHub-focused behavior is largely aligned with the stated orchestration purpose and uses official GitHub surfaces, but the skill relies on an unverified secondary skill (`code-reviewer`) and enables autonomous GitHub write actions by delegated agents. Main risk is transitive trust plus moderate autonomy, not clear credential theft or malware.