github-code-review

The skill’s GitHub access and PR-processing behavior fit its stated code-review purpose, so it is not malware. However, it carries medium security risk because it combines untrusted PR/comment ingestion, third-party `npx` execution, and autonomous GitHub actions such as posting reviews, pushing fixes, and merging; the webhook example also shows an unsafe shell-execution pattern for comment commands.