code-review-runner

SUSPICIOUS. The core purpose is coherent for a code-review skill, but it has medium security risk because it executes a spec-provided shell command, processes untrusted repository content with Bash/Write access, forwards code and diffs to external LLM services, and references a SciLLM proxy/key path that is not independently verifiable from the provided material. Not enough evidence for confirmed malware.