kie-gemini-omni

SUSPICIOUS. The network flow is aligned with the stated KIE image/video purpose and uses official KIE endpoints, so this is not confirmed malware. However, the skill is overreaching in how it acquires credentials: it instructs the agent to extract secrets from Keychain, `~/.config`, and even a personal Obsidian note, which is disproportionate to a normal API integration and creates a credential-handling risk.