minimax-h3-short-drama-video

SUSPICIOUS: the skill’s purpose and requested inputs are broadly consistent with an AI video generator, but trust in the actual data flow is incomplete because the bundled script and AI Hive endpoint ownership are not clearly verifiable from official same-org documentation. This is not confirmed malware, but credential forwarding and media upload through an unverified integration raise medium risk.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.