secure-code-review

SUSPICIOUS. The skill’s core capabilities fit its stated purpose as a source-code security review workflow, and the install paths are mostly official or docs-aligned developer tooling rather than covert payload delivery. However, it is a high-impact offensive-security skill that tells the agent not to seek additional permission, can execute many local shell commands, and requires loading two additional skills, so the overall security risk is medium even though there is no strong evidence of malware or credential theft.