hve-spielberg

SUSPICIOUS: the skill’s overall purpose is coherent for video production, and the named credentials and APIs are proportionate. However, it has a broad execution footprint, unpinned external tool installs, transitive skill loading, and moderate prompt-injection exposure from processing external browser content with write/exec permissions. This looks like a legitimate but high-trust media pipeline rather than malware.