security-app-multitenant

SUSPICIOUS. The skill’s stated purpose and file access are broadly consistent with a multi-tenant security review overlay, and there is no direct exfiltration or credential-harvesting logic in the text. However, it requires an unverifiable local appsec-sdk executable and uses Bash to invoke it, which creates a mandatory high supply-chain risk even without other malicious indicators.