githuman

SUSPICIOUS. The skill’s purpose and local data flows are coherent for a code-review helper, and there is no sign of credential theft or off-platform exfiltration. However, install trust is weakened by publisher/package ambiguity around `githuman` vs `@tequila99/githuman` and by unpinned npm execution, so the skill is best classified as medium-risk suspicious rather than benign.