agenthook-ai-influencer-ugc-video

SUSPICIOUS. The skill’s purpose and API/data flows are broadly coherent for a paid media-generation integration, and I found no clear credential exfiltration or hidden attacker endpoint. However, install trust is not fully verifiable: the skill depends on an external CLI whose package-to-service ownership linkage is unclear and whose observed version evidence conflicts with the skill’s stated minimum version. That makes this a medium/high supply-chain risk rather than confirmed malware.