language-swap

SUSPICIOUS: the skill’s functional scope matches video dubbing and captioning, and there is no evidence of direct credential theft or malicious command execution. However, it relies on remote Pika MCP tooling, rehosts media to Pika CDN, and public onboarding uses a remote endpoint plus transitive npx skill installation without strong visible verification, creating medium security risk.