code-review

SUSPICIOUS. The core review behavior is coherent and proportionate: local git inspection, repository docs, and optional spec lookup all fit the stated purpose. The main risk is transitive trust: the skill instructs installation/use of a separate third-party `publish-review` skill via an unpinned `npx ...@latest` path, extending the agent’s permissions to unreviewed external instructions. No direct credential harvesting, exfiltration, pre-execution commands, or hidden behavior appear in this skill itself.