linkpix-shipinhao-viral-video

SUSPICIOUS: The stated purpose matches video-generation behavior, and most endpoints appear vendor-related, but the skill’s core design depends on installing and trusting an external CLI that receives the user’s API token and uploads local media. With incomplete verifiable provenance for `@iqinghu/qhkit`, this is a high supply-chain and credential-forwarding risk rather than confirmed malware.