c-cloud-media

SUSPICIOUS: The skill’s capabilities broadly match its stated cloud-media purpose, but its trust model is weak. The main issue is an unverifiable local upload script that can receive file paths and indirectly handle cloud credentials, plus API traffic to partially unverifiable service endpoints including a Railway-hosted production domain. This is not confirmed malware, but it carries high security risk from credential forwarding and insufficient provenance.