diffity-resolve

SUSPICIOUS: the skill’s purpose is coherent, but its actual footprint depends on an insufficiently verified external CLI and gives the agent autonomous ability to modify code and post/resolve review comments based on untrusted review text. The biggest risks are supply-chain trust and indirect prompt injection, not confirmed malware.