video-frame-api

SUSPICIOUS. The core API call and domains are consistent with an official Pixazo integration, so there is no strong evidence of malware or credential theft to an unrelated host. However, the skill is internally inconsistent: it describes image generation/editing for a frame-extraction endpoint, instructs the agent to read and persist raw API keys, and includes a wildcard transitive skill-install command unrelated to the stated task. This is better classified as a mismatched and moderately risky skill than a malicious one.