wan-2-7

SUSPICIOUS: the core capability is coherent with a video-generation skill and the documented data flow mostly matches that purpose, but the skill asks the agent to install a separate third-party skill repo and relies on an external CLI whose publisher relationship was not fully verified from the provided evidence. The credential scope is proportionate and the network endpoints appear service-related, so this is not strong evidence of malware, but the transitive-install trust chain makes it higher-risk than a purely local documentation skill.