motion-video-director

SUSPICIOUS. The skill’s capabilities broadly match a local video-production workflow, and most API endpoints are official vendor services, but its footprint is heavy: broad web browsing plus write/exec access, many unpinned installs, MCP/server installation instructions, and optional unofficial community MCPs that may receive credentials. This looks more like an overpowered automation skill than confirmed malware, with the main risks coming from supply-chain trust and indirect prompt-injection exposure rather than overt credential theft.