asc-signing-setup

SUSPICIOUS: The skill is purpose-aligned for Apple signing administration, but its footprint is high-trust and high-impact. The main concern is dependence on an unofficial third-party CLI that receives Apple auth context and private signing identities, plus remote git-backed storage of sensitive signing assets. Data flows are mostly consistent with the stated purpose, so this is not confirmed malware, but it carries meaningful security risk.