beatra-ai-video-studio

SUSPICIOUS. The skill is largely coherent and first-party: install source, endpoints, and stated video-generation purpose align, and the pinned same-org Git checkout lowers supply-chain concern. However, it authorizes a long-lived shared token with spending scope, stores it locally, sends user prompts/media to a hosted third-party service, includes mandatory telemetry, and can route the same credential to mainland-China .cn endpoints; those data-flow and autonomy implications make the overall risk medium rather than benign.