review-lens

SUSPICIOUS. The skill’s purpose and data use are coherent for PR-review retrieval, and the prompt-injection surface is normal for this workflow. The main issue is install trust: it asks users to run an unpinned raw GitHub installer for a repo/script that could not be verified from the provided evidence, which creates a high supply-chain risk disproportionate to the otherwise benign purpose.