arcads-video-agent

SUSPICIOUS: the skill’s core behavior matches its stated Arcads media-generation purpose and data flows mostly go to official Arcads endpoints, but the install path is weaker than it should be. Cloning a third-party GitHub repo from an owner unrelated to the skill publisher and executing setup.sh to collect/store the Arcads API key creates a meaningful supply-chain and credential-handling risk. No clear evidence of malicious exfiltration or hidden behavior is present in the provided content.