ruler-progress-render

SUSPICIOUS: the skill’s purpose is coherent, but it achieves it by cloning and executing a third-party GitHub project with npm dependency installation and local script execution. That is proportionate to rendering, yet still medium-to-high supply-chain risk, especially because the actual shell script and dependency provenance are not provided for verification.

No direct malicious behavior is evident in the wrapper itself (no embedded backdoors, credentials, exfiltration endpoints, or obfuscated payloads). However, it is a high-risk supply-chain execution harness: it clones/fetches arbitrary code from an environment-controlled URL, runs npm install, and then executes repository-defined npm scripts or npx remotion render. If the remote repository or its dependency chain is compromised, this wrapper would likely execute attacker-controlled code during install and rendering.