agent-code-review-swarm

SUSPICIOUS: the core purpose is coherent for a code-review skill, and GitHub CLI usage/data flow to GitHub are legitimate. The main risk comes from unpinned third-party npm execution (`npx ruv-swarm`), autonomous GitHub write actions, and analyzing untrusted PR content with shell/write-enabled agents; this is high operational risk but not confirmed malware.