gemini-voice

SUSPICIOUS: the skill’s main capability matches its stated purpose, but it routes all access through Pixazo instead of official Google endpoints, persists a raw API key locally, and includes a wildcard transitive skill-install instruction. This is not confirmed malware, but the third-party credential/data routing and expanded trust scope make the skill medium risk.