minimax-h3-image-to-video

SUSPICIOUS. The skill's basic video-generation behavior is plausible, and its only explicit package install is a normal PyPI dependency, but the key inconsistency is that a MiniMax H3 skill routes prompts, media, and credentials through AI Hive instead of the official MiniMax API. That proxy-style data flow is not clearly verifiable from the provided evidence and creates disproportionate trust and confidentiality risk.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.