qinghu-video-audio-extract

SUSPICIOUS: The main purpose is coherent—audio extraction with ffmpeg and link resolution for share URLs—but the skill extends trust to a globally installed Qinghu CLI and forwards a user API token into it. The capability is still related to the stated purpose, so this is not fundamentally incompatible or clearly malicious; however, partial publisher verification, unpinned npm install, and optional third-party registry use make the install/data-flow posture medium risk.