chengfeng-video-styles-installer

SUSPICIOUS. The stated purpose matches the observed behavior, and there is no clear exfiltration or credential harvesting in the provided evidence. However, executing an unpinned GitHub repo through npx and using it to install another skill creates meaningful supply-chain and transitive-trust risk.