auto-review

No clear malware or covert supply-chain behavior is present. The code intentionally orchestrates Git, test shells, and external AI review tools. Security review is warranted for deployments where CLI arguments, repository contents, or environment variables are attacker-controlled, especially because --parallel-tests uses shell=True and can execute arbitrary commands. External-engine data disclosure and unrestricted output paths are additional operational risks.