aep-build

SUSPICIOUS. The skill’s capabilities broadly match its stated CI/workspace automation purpose, and its external tooling references are mostly official, but it is still high risk because it is an autonomous agent that can execute local hooks, process untrusted review/spec content, push code, open PRs, and merge without user confirmation in autopilot mode. This looks like a coherent but inherently dangerous automation skill rather than confirmed malware.