jianying-editor

SUSPICIOUS. Most capabilities align with a JianYing automation skill, and the main exporter behavior is locally scoped and proportionate. The key concern is transitive trust: this skill invokes a separate sibling skill script for AI matching, creating an external trust chain outside the stated publisher boundary; combined with unpinned external tooling/CDN guidance, this raises medium risk even without clear malware or direct credential theft.

该片段是项目说明文档，未直接包含可执行恶意代码，因此无法确认包本身含有恶意软件。但 `irm is.gd/rpb65M | iex` 会无验证地下载并执行远程 PowerShell 脚本，构成高风险安装方式，可能导致任意代码执行；应先获取并审查脚本、固定可信版本并验证哈希或签名。项目的录屏、本地工程读取、云端素材访问和未展示的依赖也需要进一步审计。

The code appears to be a legitimate filesystem utility for creating, deleting, inspecting, loading, and duplicating draft folders. There is no clear evidence of intentional malware or supply-chain sabotage. However, draft names are not validated, creating a path traversal and destructive file-operation risk if these values can be controlled by untrusted input. The syntax error in the supplied fragment also prevents execution until corrected.