shatter

SUSPICIOUS. The skill's stated purpose and runtime behavior are coherent for a local video effect, and it does not seek credentials or route data to third-party APIs. The main concern is install trust: it depends on a transitive local engine distributed via direct download from a personal domain with no evidenced checksum/signature or version pinning, which is disproportionate supply-chain risk for an AI skill even without signs of active malware.