seedream-5-lite-poster

SUSPICIOUS. The skill’s stated capabilities generally fit an image-generation workflow and its credential scope is proportionate, but the core script and actual API endpoints are missing, so the destination of prompts, images, and API keys cannot be verified. Official PyPI use is benign; the main concern is ambiguous publisher/data-flow integrity rather than confirmed malware.

No malicious code behavior is demonstrated in this fragment because it contains only static configuration. However, it embeds a plaintext API key and an external service base URL, creating a significant credential-leak and unauthorized-access risk if used by surrounding code or if the secret is reused elsewhere. Additional context (how this config is loaded and how requests are made) is required to assess whether the external calls are legitimate and whether the key is scoped/rotated appropriately.