remotion-logo-animation

SUSPICIOUS. The core Remotion/logo-animation workflow is coherent and mostly benign, but the skill expands scope by telling the agent to install another skill and to run an unpinned MCP package that receives an API key. Data flows appear publisher-aligned rather than overtly exfiltrative, so this is not confirmed malware, but the transitive trust and credential-bearing npx execution make the skill medium risk.