idm-vton

SUSPICIOUS: the main API workflow is largely coherent and uses first-party Pixazo domains, so the core virtual try-on behavior looks legitimate. However, the skill routes credentials and user image data through Pixazo as a third-party gateway, persists the API key in a local plaintext file, and includes an unnecessary wildcard skill-install instruction that broadens trust beyond this skill's stated purpose.