motion-explainer-video

整體判定為 SUSPICIOUS。技能目的與能力大致一致，主要是教學影片製作工作流，未見明顯竊密、隱匿行為或已知外洩端點；但它依賴多個外部安裝、轉移式技能安裝，以及未提供程式碼的字型下載/H3 runner/Codex 生成鏈，造成中度供應鏈與資料流不透明風險。

This utility searches Wikimedia Commons and downloads licensed thumbnails, with attribution recorded locally. Its main security issue is an unvalidated --name value that can include path traversal or an absolute path, allowing the downloaded image to be written outside the intended assets directory; impact depends on the caller’s filesystem permissions and invocation. Network traffic is directed to commons.wikimedia.org and API-provided thumbnail URLs, with no evidence of credential theft, exfiltration, or other malware. Overall severity is a moderate local file-write risk when arguments are attacker-controlled.

This is an image-processing utility with no apparent malware or data exfiltration behavior. If its JSON configuration is untrusted, an absolute or traversal-based src can read images outside the project, and an absolute or traversal-based entry name can write or overwrite files outside the treated-images directory. Severity is moderate and limited to local path handling; no domain, URL, IP, or credential indicators are present.