qwen-image-lite

SUSPICIOUS. The main API workflow is coherent for an image-editing skill and uses same-brand Pixazo endpoints, but it stores raw API keys locally and includes an unnecessary wildcard transitive skill-install instruction. Risk is moderate from trust expansion and credential handling, not confirmed malware.