media-cdn

SUSPICIOUS: the skill’s file and network capabilities fit a media-upload purpose, and its Bun/Node runtime usage is normal, but the actual backend is unverifiable because MEDIA_CDN_API_URL is fully configurable. The main risk is forwarding an API key and private asset operations to an unspecified endpoint, plus intentional public publication of uploaded files.