music-to-video

SUSPICIOUS. The workflow purpose largely matches its capabilities for media production, and the primary CLI is same-org and registry-published, but the skill expands trust by requiring self-update/transitive skill refresh before use and by installing unpinned PyPI dependencies. No clear credential exfiltration or malicious data routing is evident, yet the install/update footprint is broader than necessary for a single video skill and warrants medium-risk classification.