code-reviewer

SUSPICIOUS. The review capabilities, doc lookups, and local lint/audit commands are broadly consistent with a code-review skill, and there is no direct credential harvesting or exfiltration path. However, the skill is distributed from an unverified personal GitHub repo with weak provenance and references tooling that does not cleanly match known official OpenAI code-review integrations, making install trust the main concern.