minimax-h3-reference-to-video

SUSPICIOUS: the skill's core behavior matches reference-to-video generation, and its install footprint is modest, but it routes credentials and media through an AI Hive intermediary instead of MiniMax's direct official API. That mismatch in trust boundary and only partial public verifiability of the gateway/model surface raise medium risk, though there is no strong evidence of malware or overt exfiltration beyond the stated service workflow.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.