video-frame-extractor

SUSPICIOUS。核心功能与“视频抽帧+视觉分析”基本一致，依赖也来自正常 PyPI 路径，无明显恶意下载执行。但技能包含硬编码 Coze API Key，并引导用户将图片内容发送到发布者提供的 Coze Bot/凭据；同时允许自定义任意 VISION_API_BASE，将图片与密钥转发到非官方端点。不存在明确恶意载荷或隐蔽窃密代码，但凭据处理和数据流完整性明显不当，风险中高。

This module is best characterized as an API client that transmits user prompts and optional local image content to a remote Coze endpoint, and can save model responses to disk. There is no clear evidence of classic malware capabilities (no exec/subprocess/backdoor/persistence, no additional suspicious network destinations). However, the presence of hardcoded fallback API credentials is a serious supply-chain/secrets red flag, and the error/printing/output handling may leak remote response content into logs or saved JSON. Treat the credential handling as the key security issue requiring immediate remediation (remove hardcoded secrets, enforce configuration, and minimize stored/printed response details).