backend-review

SUSPICIOUS. The core review behavior is coherent and mostly benign, with no direct credential theft or exfiltration. Risk is elevated by the optional transitive external-skill dependency and by processing untrusted repository content while holding Bash, Write, and Task capabilities; absent the external-skill hook, this would be low-to-medium risk.