app-platform-router

SUSPICIOUS: The skill’s core capabilities are coherent with a sandbox-management purpose, and it uses standard package channels plus official DigitalOcean CLI auth. However, trust is weakened by a notable publisher mismatch: a DigitalOcean-branded skill defaults to a personal PyPI maintainer and personal GHCR images. There is no clear credential-harvesting or malicious exfiltration, but the supply-chain provenance is not clean enough to treat as benign.