aeo

SUSPICIOUS: the skill’s purpose and requested credentials mostly align with AEO analysis, but it delegates all core behavior to an unpinned third-party npm CLI and asks the agent to persist multiple API keys. This looks more like a high-trust external-tool wrapper than a self-contained skill; risky, but not clearly malicious.