cinematic-script-writer

SUSPICIOUS: The stated purpose is largely coherent for a script-writing skill, including Drive export, but the skill introduces transitive installation trust through another skills package/CLI and lacks verifiable code for the described cinematic-script tooling. The footprint is not clearly malicious, but install trust and unverifiable execution details make it riskier than a normal documentation-only skill.

No clear malicious behavior is present. The path containment check is vulnerable to sibling-prefix bypasses, and filesystem symlinks may allow access outside the configured base directory. Risk depends on whether callers can control paths and filesystem symlinks.

The code is not evidently malware, but `calculate` creates a significant code-injection risk by executing caller-controlled JavaScript through `Function`. Replace it with a safe arithmetic parser or a narrowly scoped evaluator.