asc-release-flow

SUSPICIOUS. The skill’s release-management actions match its stated purpose, and the commands are mostly normal documentation. The main issue is trust: it depends on an unofficial `asc` CLI with unclear provenance and forwards App Store Connect credentials into that third-party tool without install verification, version pinning, or publisher assurance. This is a high supply-chain and credential-forwarding risk, not confirmed malware.