meeting-to-video

SUSPICIOUS: The skill’s purpose and capabilities mostly align for local Remotion video generation, and the TTS credential scope is proportionate. Main concerns are transitive skill installation, unshown shell scripts, and npx-based execution across multiple agent environments; these raise supply-chain and trust-chain risk without clear evidence of malicious intent.

The code is a standard project setup script with no explicit malicious behavior. It relies on external package ecosystems (npm/npx) which introduces supply-chain risk if remote packages are compromised, but the script itself does not implement malicious payloads. Recommend validating the source of dependencies, using lockfiles, and considering offline installation or audit of any remotely fetched skills to mitigate risk.