What the reviewer found
Video-editing workflow (ffmpeg, Whisper, HyperFrames) where the invisible U+200B inside "concat" splits a word and hides nothing, rm -rf .waveform-cache/ clears a project cache, and the curl to generativelanguage.googleapis.com is the documented Gemini image call. It does tell the agent to look in ~/.zshrc and a reference_gemini_api_keys.md for the user's existing Gemini keys and "don't ask the user for an API key", which is credential lookup on your machine even though the key only goes to Google's own API.
credential-access— reads credentialsnetwork— calls the vendor’s API
What was read
The file as it ships in anton-abyzov/vskill:
skills/hyperframes-best-practices/SKILL.md
What the static scan said
The scan flagged 3things. The reviewer kept 0 and dismissed 3 as false.
P2Hidden instructions — false positiveRMRecursive force delete — false positiveNETMakes network calls — false positive
How this review was made
Fable 5.1 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.