app-creator

SUSPICIOUS: the overall purpose is coherent for an app scaffolding orchestrator, but the skill expands scope by default through transitive subskill installation and project-mutating shell scripts. No direct credential harvesting or off-domain data exfiltration is shown, so this is not confirmed malware, but the trust chain and autonomous repo modifications make it medium risk.