narova-runway

SUSPICIOUS. The stated purpose and data flow to Runway are coherent, and no proxy/exfiltration endpoint is evident, but the skill depends on an unseen narova CLI plus a local setup.sh and forwards a live API secret to a separate worker. Because the install path and binary/script provenance are not verifiable from the provided material, the overall risk is medium-high supply-chain and credential-forwarding risk rather than confirmed malware.