wjs-overlaying-video

SUSPICIOUS. The stated video-postproduction capabilities mostly match the skill’s purpose, and the HyperFrames render path looks legitimate. The main risk is disproportionate trust in a third-party cover-generation skill that may download/bootstrap external binaries and receives Codex/OpenAI auth from ~/.codex/auth.json. That credential-forwarding and transitive dependency chain makes the overall skill high-risk even without clear proof of malicious intent.