web-media-getter

SUSPICIOUS. The skill’s purpose and requested capabilities are mostly coherent for media retrieval, and its documented data flows to official media providers are proportionate. However, the reviewed artifact is incomplete, requires external scripts and env files, and upstream installation depends on a mutable raw GitHub download from a personal publisher without verifiable release integrity. That makes this primarily a high install-trust/supply-chain risk rather than confirmed malware.