ernie-image

SUSPICIOUS. The main capability matches the stated purpose, but the skill routes prompts and the user’s API key through Pixazo’s third-party gateway instead of an official Baidu API, and it encourages broad transitive skill installation. Not confirmed malware, but the gateway credential flow and wildcard skill-install instruction make the trust model weaker than a direct vendor integration.