avatar-ambient-sfx

Purpose and media-processing behavior are coherent, and the only named external service is the official ElevenLabs API. The main issue is transitive trust: this skill depends on unverified local executable scripts from another skill and passes an API key into them, which raises security risk substantially even without evidence of confirmed malware.