gbro-collage-broll

SUSPICIOUS: the skill’s purpose and capabilities mostly align with media generation, and the API key requirement is proportionate, but trust is reduced because execution depends on unseen scripts from a personal GitHub repo with no shown release verification. This looks more like supply-chain and credential-forwarding risk than confirmed malicious behavior.