video-frame-extractor

SUSPICIOUS. The core functionality is consistent with a video-frame analysis skill and uses normal PyPI dependencies, but the embedded COZE API key is a serious red flag and the arbitrary VISION_API_BASE setting allows credential and image forwarding to untrusted endpoints. Main risk is credential exposure and third-party data routing, not overt malware.

This module is best characterized as an API client that transmits user prompts and optional local image content to a remote Coze endpoint, and can save model responses to disk. There is no clear evidence of classic malware capabilities (no exec/subprocess/backdoor/persistence, no additional suspicious network destinations). However, the presence of hardcoded fallback API credentials is a serious supply-chain/secrets red flag, and the error/printing/output handling may leak remote response content into logs or saved JSON. Treat the credential handling as the key security issue requiring immediate remediation (remove hardcoded secrets, enforce configuration, and minimize stored/printed response details).