meitu-skills

SUSPICIOUS. The skill’s purpose and file/output scope are broadly coherent for video denoising, but it forwards API credentials to an external CLI whose official package ownership and release provenance were not fully verified. That makes this primarily a supply-chain and credential-forwarding risk rather than confirmed malware.

SUSPICIOUS: The skill’s purpose and file/exec scope are broadly consistent with video element removal, and Meitu brand ownership is plausible. However, it requires an unverifiable local `meitu` CLI, reads raw credential files, and forwards credentials to that CLI without a confirmed official install or signed release path, making the overall risk medium-high rather than benign.