google-veo

This skill README describes a legitimate-sounding wrapper around a third-party CLI (infsh) that provides access to Veo text-to-video models. The main security concerns are supply-chain and privacy risks: the Quick Start uses a curl|sh installer pattern (download-and-execute), binaries come from dist.inference.sh, and the skill routes user prompts/credentials through the inference.sh service rather than official Google endpoints. Additionally, recommending 'npx skills add' and granting broad CLI permissions increases transitive trust and potential for credential forwarding or arbitrary code execution. There is no evidence in the provided documentation of explicit exfiltration code, obfuscation, or embedded backdoors, but the install-and-run pattern plus transitive installs and credential use make this a moderate-to-high supply-chain risk. Users should verify installer checksums from a separate, trusted channel, prefer vetted package sources, and avoid entering sensitive secrets unless the service and storage practices are audited.