cross-review

SUSPICIOUS: the stated purpose matches cross-review, and the Codex install/auth path appears official, so there is no strong malware signal. Risk comes from autonomous multi-round file edits, dynamic invocation of other skills, and reviewing potentially untrusted repo content while retaining write/exec capability.