qiaomu-cut

该技能的总体目的与视频制作能力基本一致，但实际足迹很重：会自动安装缺失依赖、调用多个外部 CLI、向第三方服务上传本地内容，并支持持续授权绕过逐次确认。最主要风险不是目的伪装，而是供应链与凭据/内容转交给外部工具的高信任要求；应归为 SUSPICIOUS 而非确认恶意。

No clear malware or data-exfiltration behavior is visible. There is a filesystem path traversal risk: untrusted scene.id values are used to construct output paths without containment checks, allowing unintended file writes when materialization runs. Validate scene IDs against a restrictive filename pattern and verify resolved output paths remain within the scenes directory.

SUSPICIOUS. The core routing purpose is coherent, and the CLI install/auth flow appears to use the vendor's official npm package and official endpoints, so this is not a strong malware signal. However, the skill is overreaching for a router by automatically performing global install and login actions and explicitly telling the agent to do so silently, which is disproportionate and reduces user awareness. The URL-parsing route also adds indirect prompt-injection surface, though that is secondary to the autonomy/transparency issue.

This is an AI-assisted GitHub workflow, not evident malware. Its principal risk is that issue, comment, or review text can influence Claude Code while the job has substantial write permissions. Bot-authored events bypass the association checks. Review the action's safeguards and minimize permissions, particularly for untrusted event content.