apm-usage

SUSPICIOUS: the skill is internally consistent as an APM usage guide, but its main purpose is to install and activate other skills, which creates a significant transitive trust and supply-chain risk. No clear exfiltration or deceptive routing is shown, so this is not confirmed malware; risk comes from arbitrary skill installation, hook execution, and credential-assisted private repo access.