kanban-video-orchestrator

SUSPICIOUS: the core workflow is broadly aligned with a video-orchestration skill, but it has a larger-than-average footprint: profile creation, shell-script execution, broad terminal/file access, direct secret retrieval from local stores, and forwarding of API keys to multiple third-party services. No confirmed malware or deceptive exfiltration endpoint is present, and the explicit package install is a pinned PyPI dependency, but the credential handling and breadth of external tool/API integrations make the skill medium risk.

This is a project-file and shell-script generator, not apparent malware. It has a clear shell-injection risk: unvalidated plan values, especially `api_keys_required`, are inserted into generated commands. The risk occurs when the generated setup script is executed; the module itself only writes files. Review and quote all plan-derived shell values and inspect the referenced templates.