openbmb-voxcpm2

SUSPICIOUS. The core TTS capability is mostly coherent: it uses same-org Pixazo console, docs, and gateway for a Pixazo-mediated Openbmb model. However, the skill forwards credentials and content through a third-party gateway instead of the model vendor directly, persists the API key locally, and includes an unrelated wildcard transitive-skill install instruction. This is not confirmed malware, but it has medium security risk from credential routing and expanded trust.