lov-media-fetch

SUSPICIOUS: the skill’s capabilities are broadly aligned with its stated media-download purpose, and the scanner’s command-injection hits are documentation false positives. Main concerns are autonomous end-to-end downloading from broad external sources and a transitive handoff to another skill, not confirmed malware or credential theft.