ad-render

SUSPICIOUS. The skill’s purpose and local file access are coherent for video ad rendering, and Remotion/Node usage is normal. The main risk is install trust: an unverified kai-render scaffolder generates the project and dependency manifest later fed into npm install, creating a meaningful supply-chain risk even though no explicit credential theft or exfiltration is described.