pull-back-reveal

BENIGN wrapper behavior with SUSPICIOUS install trust. The stated purpose matches the capability, and no credential harvesting or explicit exfiltration is present, but the real execution depends on an unverified separate 'video-effects' engine and transitive tooling whose provenance is not established here.