paper-collage-ad-production

SUSPICIOUS: the skill’s capabilities mostly fit its stated media-production purpose, and official Homebrew dependencies are expected. The main concern is install trust: a local setup script downloads the voice-cloning runtime/models from unspecified upstream sources, with no visible pinning or integrity verification, and optional API scripts hide actual credential/data flows. This is better classified as elevated supply-chain risk than confirmed malicious behavior.