vhscli

SUSPICIOUS. The skill's capabilities mostly match its stated media-analysis/generation purpose, and the install path uses the official npm registry, but it requires executing an unpinned `@latest` package on each run and routes user data through VHS-managed backend services instead of direct provider APIs. This looks more like a high-trust thin-client integration than outright malware, but the mutable install path and centralized third-party data flow raise meaningful security risk.