lov-media-fetch

SUSPICIOUS. The main workflow is internally consistent for media downloading, and there is no clear credential theft or covert exfiltration. However, the skill combines autonomous network/file actions, multi-source untrusted discovery, optional third-party qBittorrent search plugins, and transitive skill loading, which makes its operational footprint riskier than a simple downloader.

SUSPICIOUS: the skill’s capabilities mostly match its stated media-discovery purpose, but it deliberately searches torrent/DHT ecosystems and may route queries through unofficial qBittorrent plugins or other third-party indexes. No explicit credential theft, stealth, or direct malware behavior appears, yet the external search/plugin trust boundary and untrusted-content ingestion make it medium risk.