flow-next-spec-completion-review

SUSPICIOUS: the skill’s purpose is coherent, and it does not show overt credential theft or deceptive data routing, but it grants an agent autonomous code-fixing/committing behavior and sends repo context to external AI review backends. Main concerns are autonomous real-world repo actions and reliance on an unverifiable bundled helper script, not confirmed malware.