goose-video

SUSPICIOUS: the skill's core purpose is coherent for local video ad rendering, and its primary data flows target official GooseWorks MCP/proxy services, so it is not outright malicious. However, it materially expands trust by reading raw credentials, fetching additional skills/recipes at runtime, and running unpinned installs/external toolchains, which creates medium security risk and a notable transitive supply-chain surface.