agent-music-video

SUSPICIOUS. The skill’s capabilities broadly match its stated music-video production purpose, and its core tooling references are official and same-org. The main risk comes from its large execution footprint, unpinned dependency installs, browser/audio tooling, and explicit transitive skill installation; these are proportionate but expand trust significantly. No clear credential theft, covert exfiltration, or malicious mismatch is present.

This is a configurable browser screenshot and layout-measurement tool, with no clear evidence of malware or independent data exfiltration. Treat its JSON configuration as trusted: arbitrary page-context JavaScript, unrestricted navigation, and unvalidated output names create meaningful execution, network-access, and filesystem path-traversal risks if an attacker can supply the configuration. Chromium's disabled sandbox further increases exposure to malicious pages.

This appears to be a local placeholder-generation utility, not malware. Treat storyboard files as trusted: an untrusted storyboard can direct writes to arbitrary accessible paths and can inject code into generated HTML through the frame id. Restrict and validate output paths, and apply context-appropriate escaping to identifiers.