clipcast-audio2video

SUSPICIOUS. The stated video-generation purpose is coherent, and the named external services are official, but the actual core tool is not distributed through a verifiable source and is referenced via a personal local path. Because the skill asks users to place Gemini and Pexels API keys in a .env that is then consumed by this unverifiable local tool, the install-trust and credential-forwarding footprint is disproportionate and high risk even without evidence of confirmed exfiltration.