wechat-2d-render

SUSPICIOUS. The skill’s purpose matches video rendering, but it achieves this by cloning a low-verifiability personal GitHub repo, tracking its mutable default branch, installing dependencies, and executing repo scripts. That is proportionate to the task but still a high supply-chain trust risk due to weak provenance and lack of pinning or release verification.