video-gen

SUSPICIOUS: the skill’s purpose is coherent, but trust and data-flow transparency are incomplete. The main concern is that requests and optional image uploads appear to go through a Max intermediary using MAX_API_KEY, while the actual script and exact endpoints are not shown; this is medium risk rather than confirmed malicious behavior.