app-store-connect

SUSPICIOUS: the skill's purpose is coherent, but its footprint is broad for an AI skill. It forwards sensitive Apple credentials and signing material into multiple third-party CLIs, includes browser/web-session automation, optional cloud verification, external S3 publication, and a transitive skill install. I see no confirmed malware or hidden exfiltration, but the install trust and credential-forwarding risks are substantial enough to rate this medium-high risk.