ai-full-code-review

SUSPICIOUS. The core review behavior and local vault writing are broadly consistent with the stated purpose, and there is no external download, credential harvesting, or obvious exfiltration in this snippet. Risk rises because the skill performs autonomous local file writes in a user-wide Obsidian vault and then delegates commit/push to an unreviewed transitive skill (`ai-commit`), creating a trust chain for real-world state changes without showing that downstream skill’s provenance or behavior.