pp-twelvelabs

SUSPICIOUS. The skill’s capabilities broadly fit its Twelvelabs video-analysis purpose, and the installer appears tied to the same publisher identity rather than an obviously unrelated host. But it materially expands trust to an external CLI, uses an unpinned go-install fallback, supports arbitrary webhook delivery of outputs, and can read persisted API credentials from local config. These are proportionate enough to avoid a malicious verdict, but the install trust and data-routing surface make it higher risk than a normal documentation-only skill.