java-code-review

This skill implements a reasonable GitLab-based Java code-review workflow, but it omits declaring the GitLab credential it requires and includes company-specific rules. Before installing or running it: (1) confirm where the GitLab token should come from (do not put a high-privilege token in a shared file); prefer creating a least-privilege PAT that can read repositories and create/accept merge requests only if you intend to allow merges; (2) confirm the GitLab host (the SKILL.md uses https://git.xxx.com by default) and update it if needed; (3) review and accept the organization-specific checks (package-name enforcement, ORM rules) or edit them out; (4) verify where CR reports will be stored and whether that directory is acceptable for sensitive info (reports may include file diffs and authors); (5) test the skill in a sandbox project with a limited token so you can observe behavior (including network calls and file writes) before using it with production credentials. If you want greater assurance, ask the publisher to explicitly declare required env vars/credentials and to confirm that the agent will only read tokens from a documented, user-approved location.