wjs-voicedrop-creating-motion-book

SUSPICIOUS: the skill is mostly coherent with its stated motion-book production purpose, but it has a large operational footprint: root cloud automation, shared long-lived credentials, unattended Claude execution, and automatic public publishing. No strong evidence of hidden exfiltration or malware, yet the permissions and autonomous external actions are broader than a typical content-processing skill and warrant caution.

This CLI utility manages local JSON state and summaries, but its get command executes a command-line-supplied JavaScript expression through new Function, creating a code-execution risk if that input is untrusted. State and event file paths are also caller-controlled and are not restricted to a safe directory. No network activity, credential theft, or other malware behavior is present in the fragment; severity is context-dependent and primarily concerns unsafe use with untrusted inputs.