app-aso

SUSPICIOUS. The skill’s main ASO audit purpose is coherent and most data flows point to official Apple/Google tooling, but it also instructs use of an unpinned third-party npm package from an unrelated publisher for keyword measurement. That added supply-chain footprint is not strictly necessary for the stated purpose and raises medium risk, though there is no clear credential theft, covert exfiltration, or fundamentally incompatible behavior.