github-code-review

SUSPICIOUS. The core GitHub review capabilities are coherent and the network flow goes only to official GitHub endpoints, so this is not malware-like. Risk comes from reading raw credential files, checking out untrusted PR content, and enabling the agent to run tests and post review actions on behalf of the user; these behaviors make the skill moderately risky despite a legitimate purpose.