seedream

SUSPICIOUS: the main Seedream workflow is internally coherent and uses official Pixazo-owned domains, but it forwards prompts/images and credentials through Pixazo as an intermediary rather than BytePlus directly, stores the raw API key locally, and includes a wildcard transitive skill-install suggestion. Not malware, but medium risk due to third-party gateway credential routing and transitive trust.