dd-apm

SUSPICIOUS: The skill’s core behavior fits its Datadog SSI configuration purpose, and most host/file/process access is proportionate. The main security concerns are disabled SSH host verification, broad remote inspection of process environments, and transitive trust in other skills and a preexisting CLI; these make it medium-risk rather than benign, but not malicious.

SUSPICIOUS. The skill’s capabilities mostly align with Linux SSI troubleshooting and its network endpoints are official Datadog/GitHub sources, so this is not fundamentally incompatible with its stated purpose. However, it carries medium security risk from remote shell access, disabled SSH host-key checking, unpinned download-and-execute installation patterns, and forwarding Datadog credentials into a remote install script. These are proportionate but operationally risky rather than clearly malicious.