google-virtual-try-on

SUSPICIOUS. The core capability is coherent for virtual try-on, but the skill’s branding implies Google while actual data and credentials flow to Pixazo’s third-party gateway, which is a meaningful integrity mismatch. Secret persistence in ~/.pixazo/api-key is somewhat broad but still related to the task. The wildcard transitive skill-install suggestion is disproportionate and raises trust risk beyond the main API workflow.