peer-review

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly writes user-provided briefs to a repository-hidden temp file and unconditionally sends that content to external model CLIs (codex/claude) while removing the temp file on exit, creating a high risk of unintended data exfiltration and evidence-hiding despite no explicit remote-shell or obfuscated payloads.