video-asset-reels

SUSPICIOUS: the skill’s media-processing behavior is broadly aligned with its purpose and it does not request credentials or route data to strange APIs, but its primary install model relies on transitive trust in a third-party GitHub-hosted skill via the skills CLI. That makes it a moderate supply-chain risk rather than clearly malicious.