lyric-music-video

SUSPICIOUS. The skill’s capabilities are broadly aligned with making lyric music videos, but its trust boundary is weakened by an unreviewable setup script, reliance on a personal GitHub engine repo, and optional third-party/remote execution paths. I do not see clear credential theft or exfiltration behavior, but install provenance and remote-render workflow details are insufficiently verifiable.

This appears to be a video-rendering utility, not malware. It has a significant path-handling risk: an untrusted NAME can redirect recursive deletion and output writes. Validate NAME as a simple filename and verify resolved paths remain within the intended renders directory. Avoid constructing Python source from interpolated values.