davinci-resolve-pro-edit

SUSPICIOUS. The skill’s capabilities broadly match its stated video-editing purpose, and the flagged command-injection findings are documentation artifacts, not executable pre-load payloads. The main concern is medium supply-chain risk from relying on a community Resolve MCP, setup scripts, and unpinned runtime package execution; this is risky but not fundamentally incompatible with the skill’s purpose and not clear evidence of credential theft or malware.

The code performs video background-removal processing and shows no clear data theft or malware behavior. However, unvalidated command-line IDs are interpolated into shell=True commands and paths, creating command-injection and path-traversal risks. The npx fallback also downloads or runs a package through the package registry.