devex-review

SUSPICIOUS. The stated DX-audit purpose is plausible, but the skill's actual footprint is much broader: it auto-runs numerous unverifiable local gstack binaries, manages telemetry/artifact sync, and can modify repo files and commits. Official gh/glab/bun usage is mostly coherent, so this is not confirmed malware, but the custom binary trust gap and extra data flows make the skill high-risk and not tightly scoped to its stated purpose.