minimax-h3-storyboard-to-video

Overall footprint is mostly coherent for a remote video-generation skill: prompt input, media upload, task polling, and result download all fit the purpose. Main concern is trust and data-flow integrity: the skill sends API keys, prompts, and media through AI Hive as an intermediary, and the actual script/endpoints were not provided to verify whether this is an official or well-documented provider path. That makes it suspicious rather than clearly malicious.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.