motion-video

SUSPICIOUS. The skill’s media-production capabilities fit its purpose, but it requires an unverified third-party CLI (multix) and forwards provider credentials through it. Because that binary/tool provenance is not established and the credential path is opaque, the skill carries high security risk despite otherwise coherent workflow scope.

This is an audio-asset generation script with expected file creation and external CLI use. It has a command-injection weakness because untrusted JSON values are passed through a shell using insufficient quoting, and output IDs are not constrained to their asset directories. The fragment does not itself show clear malicious intent; risk depends on whether its JSON inputs can be attacker-controlled.

This appears to be a media-alignment utility, not clear malware. It has command-injection and path-traversal risks if scene data is untrusted or compromised. Avoid shell execution and validate scene IDs and resolved paths.