filmcraft-video-export

SUSPICIOUS: the core FilmCraft export workflow is coherent and mostly local, but the skill unnecessarily expands trust by telling the agent to install a second skill. Because that transitive install uses an apparently legitimate npm + skills.sh + GitHub path and there is no credential harvesting, exfiltration, or remote-code pipe-to-shell behavior, this is better classified as medium-risk trust expansion rather than malware.