ai-audio-generation

No direct embedded malware is evident from the provided fragment (it is documentation/guide content rather than executable module code). The dominant security concern is instruction-level enablement of high-risk behaviors in downstream automation: (1) executing a command value returned by a hosted service (remote-to-local arbitrary command execution pathway) and (2) using npx with @latest/implicit/unpinned versions (mutable dependency/supply-chain execution risk). These should be reviewed and hardened (pin versions/integrity verification; strictly validate/allowlist hosted command fields or avoid executing service-supplied commands).

SUSPICIOUS: The skill's core purpose is coherent, but it relies on unpinned NPX execution and a transitive skill installation path from a third-party GitHub repo. Data flow to Luxin-hosted services is disclosed and broadly consistent with the product's stated model, so this is not confirmed malware, but the install trust and hosted intermediary design make it medium risk.