veo

SUSPICIOUS. The core behavior is coherent for video generation, but the skill presents Veo 'by Google' while actually routing prompts and credentials through Pixazo's gateway, a third-party intermediary. Credential storage in ~/.pixazo/api-key is proportionate but more invasive than a standard auth flow, and the wildcard transitive skill-install recommendation is unrelated scope expansion. No confirmed malware or exploit behavior was found.