minimax-h3-tvc-video

SUSPICIOUS: the skill’s core behavior is mostly consistent with a video-generation workflow, but it routes credentials, prompts, and uploaded media through AI Hive instead of MiniMax’s official API path. With only a standard PyPI dependency and no download-execute chain, this is not confirmed malware, yet the intermediary data flow meaningfully raises security risk and trust requirements.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.