hiapi-video-prompt-generator

This module behaves like a typical installer that clones remote code into local “skills” directories and replaces any existing installation. It does not show overt malicious functionality (no obvious data theft/exfiltration/persistence). However, it carries meaningful security risk due to (1) potential command-injection exposure from using execSync with a shell-interpreted string where the destination path is derived from user/environment inputs, (2) destructive recursive deletion tied to those inputs, and (3) supply-chain integrity risk from cloning an unpinned remote repository without verification.