alayarenderer-generative-world

SUSPICIOUS: the skill’s functional scope matches a video rendering workflow, but install trust is inconsistent. The biggest issue is provenance mismatch between the skill publisher, the instructed GitHub org, and the apparent canonical upstream, plus transitive submodule trust and unofficial-looking model weight hosts. No clear credential theft or exfiltration behavior is present, so this looks more like a supply-chain/provenance risk than confirmed malware.