apps-connect

SUSPICIOUS. The skill’s purpose is coherent and its direct data flow to `api.theapps.jp` is plausible, but it depends on a high-trust third-party Apps-mcp CLI whose official relationship to `theapps.jp` could not be verified. The main risk is supply-chain and credential forwarding to unverified setup tooling, not confirmed exfiltration or malware.