feature-review

This utility loads local and GitHub-hosted review guides, but untrusted REVIEW.md entries can exploit unchecked path traversal to read files outside the project root or write fetched content outside the intended cache directory. The GitHub request uses the gh CLI without a shell and no direct credential theft or exfiltration behavior is present. Severity is a security warning dependent on processing attacker-controlled project metadata.