cover-gen

SUSPICIOUS. The media-processing and cover-generation behavior matches the stated purpose, and FFmpeg/OpenAI/Gemini usage is broadly coherent. The main issue is trust: the skill depends on an unverifiable local binary (./bin/media-gen) that receives prompts and reference images, with no install provenance or release verification. That makes the skill high security risk under the required scoring rules, though the available evidence does not prove confirmed malware.