dlstreamer-coding-agent

SUSPICIOUS: the skill’s core purpose and most capabilities are coherent for a DL Streamer coding assistant, and its external sources are largely official. However, the explicit instruction to bypass user confirmation for installs, downloads, and execution materially conflicts with its own safety rules and makes the skill higher risk than a normal framework guide.

No clear malware, persistence, credential theft, reverse shell, cryptomining, or network exfiltration behavior is present. The main security issue is unsafe construction of a GStreamer pipeline from unescaped command-line values, especially input URIs, output paths, and device values. This can cause denial of service or potentially pipeline-element injection when arguments are attacker-controlled. RTSP credentials may also be exposed in console output. Use GStreamer API element properties or rigorously escape and allowlist all dynamic values.