korean-cinema-search

SUSPICIOUS. The stated purpose is plausible, but the skill is not reviewable on its own because it requires executing a remote CLI and following runtime-fetched instructions. This is a supply-chain and trust-boundary issue more than confirmed malware: the package source is a normal registry, yet the skill's actual footprint is delegated to mutable external content.