pesty-explainer

SUSPICIOUS. The skill's capabilities mostly match its stated purpose as a branded video-production workflow, and the scanner's command-injection hits are documentation artifacts rather than active execution tricks. The main concern is transitive trust: it requires another skill to be installed and then runs that skill's setup/render/TTS scripts, which expands the trusted footprint and likely forwards narration text and credentials to external services like ElevenLabs. No clear credential theft or unrelated data exfiltration is evident from this skill alone, but the dependency chain makes it higher risk than a self-contained documentation skill.