review-it

SUSPICIOUS: the stated purpose is coherent for a PR review workflow, but the skill’s trust boundary is wider than a simple review helper because it relies on third-party skills/local agent infrastructure and mandates full-access subagents that can review, modify, and commit code. No clear credential theft or exfiltration is present, so this is not malicious, but the autonomy and third-party dependency chain make it medium risk.