jianying-recover

SUSPICIOUS/VULNERABLE rather than confirmed malware. The skill’s behavior is largely aligned with its recovery purpose and includes strong fail-closed guardrails, but it depends on an externally installed `jianying` CLI whose official provenance is not established by the provided evidence. With no credential collection or obvious exfiltration, the main issue is unverifiable dependency trust, not malicious intent.