moneyprinterturbo-video

SUSPICIOUS: the skill's purpose broadly matches video generation, but it also auto-installs tooling and can download/execute remote helper code. Data flow appears aligned with MoneyPrinterTurbo rather than an unrelated credential sink, so this is not confirmed malware; the main concern is medium supply-chain and autonomy risk from remote installers and automatic execution.

This code fragment is primarily a bootstrap/configuration/execution wrapper. It does not show explicit malware behavior (no credential theft, exfiltration, or obfuscated payloads). However, it has notable supply-chain risk: it downloads a ZIP from a public GitHub repository at runtime and then installs and executes the downloaded project’s cli.py. There is no cryptographic integrity/pinning check of the downloaded archive. User-controlled CLI arguments are also passed through to the executed cli.py, increasing behavioral risk depending on the downstream code. Overall, likely legitimate but requires supply-chain hardening (pinning, hash/signature verification) and review of the downstream cli.py/lockfiles.