megadev-streaming

SUSPICIOUS: the skill’s purpose and capabilities are coherent and there is no sign of credential theft or hidden exfiltration, but it asks the agent/user to run an unpinned third-party Docker image whose provenance is not clearly the same as the cited upstream project. Main risk is supply-chain trust, not malicious behavior in the documentation itself.