peer-review

SUSPICIOUS: the core review behavior is broadly aligned with the stated purpose, but the skill expands trust to external LLM CLIs from other vendors and can transmit potentially sensitive diffs/PR content outside the current runtime. Official package sources and explicit consent/secret-scan mitigations keep this from looking malicious, but the external-model path and untrusted-content processing make it a medium-risk skill.