seedream-5-lite-image-to-image

SUSPICIOUS: The skill's stated purpose broadly matches its capabilities, and its explicit dependency install is benign. However, the trust-critical behavior is hidden inside an unseen local script that receives API credentials, uploads local images, performs live remote calls, and downloads files, while public evidence does not clearly verify the claimed provider naming, config path, or model identifier as official. This is not confirmed malware, but the unverifiable endpoint and credential-routing details create medium risk.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.