altllm-portal-api-keys

The stated purpose is coherent for an API-key management skill, but the trust boundary is weak because all sensitive operations are delegated to an undocumented local `altllm` CLI with no verifiable provenance in the skill. Since that executable receives and returns API key material, this is a high security-risk skill even without direct evidence of overtly malicious behavior.