studio-setup

SUSPICIOUS. The skill's core setup actions are mostly aligned with its video-studio purpose, but it meaningfully expands trust: it installs remote scripts via curl|sh, modifies Claude command allowlists, and optionally funnels social-account workflows through Treg's third-party proxy/service instead of direct platform APIs. This is not confirmed malware, but the install and credential-routing footprint is broader than a minimal local setup skill and warrants medium risk treatment.