mascot-video

SUSPICIOUS. The skill’s purpose and requested credentials are mostly coherent for mascot/video generation, and vendor API usage appears proportionate. The main concern is install trust: a repo-local shell installer for Rhubarb is unverifiable from the provided skill text, so the skill carries elevated supply-chain risk even without signs of credential theft or malicious data routing.