resolve-reviews

SUSPICIOUS: the skill’s purpose is coherent, but it relies on an unpinned third-party npm CLI that receives GitHub credentials and can take autonomous repo actions. Data flow is mostly consistent with GitHub PR review workflows, yet credential forwarding, runtime package execution, endpoint override capability, and automatic commit/push/reply behavior make the overall risk medium rather than benign.