creative-media

SUSPICIOUS: the stated purpose matches the capability of a hosted creative-media runtime, but the skill relies on unpinned remote `npx` execution and explicit transitive skill installation. Data flows to Luxin-hosted infrastructure are coherent with the purpose, yet persistent hosted outputs and remote retention increase privacy risk. Main concern is install/upgrade trust rather than clear malicious behavior.