gemini-omni-1-1

SUSPICIOUS. The main video-generation behavior is coherent, but the skill routes credentials and user content through Pixazo instead of an official Google endpoint, stores the API key in a local dotfile, and includes a transitive skill-install instruction unrelated to its narrow purpose. No confirmed malware or hidden execution is present, but the third-party gateway and trust expansion make the skill medium risk.