hunyuan-video

SUSPICIOUS: the core behavior mostly matches the stated purpose, and the Pixazo endpoints appear to be official same-org infrastructure. The main concerns are that the skill routes Tencent-related usage through Pixazo as a credentialed intermediary, stores the API key in a raw local file, and encourages wildcard installation of additional skills. This is not confirmed malware, but it has medium security risk due to third-party credential routing and transitive trust.