nebulavault-media-downloader

SUSPICIOUS. The skill's media-downloader functionality is plausible, but the installation trust chain is not coherent with the stated publisher or product identity. Downloading and executing a tarball from an unrelated personal GitHub repo/release is a major supply-chain risk, even though the rest of the document mostly looks like normal usage documentation.