appshot-core

SUSPICIOUS. The skill’s footprint mostly matches its stated purpose of local project extraction for Appshot, and there is no remote installer, third-party gateway, or exfiltration endpoint. However, it uses load-time pre-execution commands to read project files before user approval, which is disproportionate from a trust perspective even if the reads are purpose-aligned and local-only.