youtube-shorts-generator

SUSPICIOUS: The skill’s capabilities broadly match its stated purpose, but its trust footprint is larger than necessary: it asks the agent to clone and execute an unpinned third-party repo and send user media, transcripts, and an API key through a third-party MuAPI service that handles nearly the entire pipeline. This is not confirmed malware, but it has meaningful supply-chain and data-flow risk.