comic-drama-video

SUSPICIOUS: The capability matches the stated purpose of AI video generation, and the only explicit package install is low risk. However, the skill routes prompts, media, and API credentials through an unseen local script to a provider/API that the supplied evidence did not clearly verify as an official documented service, so the trust and data-flow picture is incomplete.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.