happy-horse-image-to-video

SUSPICIOUS: the stated purpose and visible capabilities are coherent for an image-to-video API skill, and the install step uses a standard PyPI package. However, the publisher/auth/endpoint details are internally inconsistent with the cited official Hive documentation, and the bundled script that handles uploads and API keys is not visible, so credential routing and remote data flow cannot be verified.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.