pixelforge

SUSPICIOUS: the core PixelForge API behavior is mostly coherent and routes data to same-vendor Pixazo endpoints, but the skill is overreaching in credential handling by reading/writing a raw API-key file and is notably weakened by the unverified wildcard transitive skill-install instruction. Main risk is transitive trust and local credential persistence, not confirmed malware.