video-clone

SUSPICIOUS. The core capabilities mostly match the stated purpose of video analysis and production orchestration, and the named tools/domains are legitimate and proportionate for media handling. Main risks are transitive skill installation ('help the user find and install a trusted open-source skill'), broad web searching, and URL downloading via external tooling; these expand trust beyond the immediate skill. No clear credential harvesting, secret-file access, covert behavior, or off-purpose exfiltration is present, so this is not malicious, but it carries medium security risk from supply-chain and delegated-skill execution.

The code loads and resolves animation-score JSON and can save shot JSON. `save_shot` does not constrain `shot['id']` before using it as a path component, so crafted identifiers can cause writes or replacements outside the intended `shots` directory, subject to process permissions. No network exfiltration, credential theft, command execution, or other malware behavior is present in this fragment. Severity is moderate due to the arbitrary-path write risk; no suspicious domains, URLs, IPs, or credentials are present.

The code appears to be a browser-based animation renderer. The string-to-`eval` path in `renderSheet` is a significant code-injection risk if `at` can contain untrusted values. No direct evidence of data theft, external communication, or other malware appears in the provided fragment.

The code appears to be an asset-search and download utility, not malware. The unrestricted download URL and unvalidated output filename are meaningful security risks: they can permit arbitrary outbound requests and writes outside the intended assets directory when inputs are controlled by an untrusted party. Restrict URL schemes and hosts, validate filenames and project paths, and avoid exposing API keys in logs.