app-context

SUSPICIOUS: The skill’s purpose and actions are mostly coherent and it contains no direct exfiltration or dangerous commands, but dependency provenance is unclear. Risk comes from relying on an external MCP/tooling path that may involve unpinned npx execution, localhost HTTP, and possible credential forwarding to a third-party app-store-connect-mcp implementation if the official ASO.dev path is not used.