media-toolkit

SUSPICIOUS: the skill’s media upload/transcription capabilities fit its stated purpose, but it reads raw local credential files and forwards both secrets and media through repo-local tooling to unspecified backend endpoints. The main concern is execution/data-flow opacity rather than clear malicious intent.