spotlight

SUSPICIOUS: the stated purpose is coherent for a video effect skill, and the visible file access is proportionate, but the actual execution depends on an unverified external `video-effects` engine with no install provenance in this skill. Risk is driven by transitive trust and setup-time supply-chain exposure, not by clear exfiltration or confirmed malicious behavior.