differential-review

SUSPICIOUS. The core capability is aligned with a differential security-review skill, and there is no clear credential harvesting or exfiltration. Risk comes from Bash-enabled analysis of untrusted code/diffs, plus references to another skill and an unspecified `issue-writer` CLI that introduce transitive trust and provenance uncertainty.