scene-inventory-extractor

Purpose and capabilities mostly align with a scene-breakdown/image-prep workflow, and there is no direct malware pattern in the skill text. The main concern is data-flow trust: it routes narrative content and image operations through a named MCP that may be third-party, with silent autonomous generation and likely credential forwarding outside the official API boundary. Overall this is better classified as suspicious/high-friction integration risk than malicious.