codebase-audit-pre-push

SUSPICIOUS: the skill’s core purpose is coherent for a pre-push audit, but it is broad and powerful. The main risks are repository-wide read/write access, inspection of secret files, and suggested delegation to other community skills. There is no explicit credential exfiltration, remote installer, or attacker-controlled endpoint in the provided skill text, so this is not confirmed malicious.