gpd-metadata-sync

SUSPICIOUS. The skill's actions are coherent with Google Play metadata management, but its operational footprint depends on a non-official third-party CLI from a personal GitHub source. That makes install trust and credential forwarding the main concerns; no direct malicious or exfiltration behavior is shown in the skill itself.