iap-finalizer

SUSPICIOUS/HIGH-RISK vulnerable skill, not confirmed malware. Its stated purpose and Apple API targets are coherent, but the core operation relies on an unverifiable local helper (asc.py) that handles App Store Connect credentials and performs write actions; under the required scoring rules, that black-box credentialed executable path drives the risk high.