vid-sizzle-reel

SUSPICIOUS: the skill’s purpose is coherent and it does not request credentials or route data to suspicious endpoints, but it relies on transitive installation of a third-party skill plus unpinned npx execution and a CDN-loaded script. This looks more like a legitimate media-generation workflow with supply-chain and trust-chain risk than malware.