grok-imagine-image

该技能的功能表面上与“生成图片”一致，但默认把 prompt 与 API key 发送到一个非官方、明文 HTTP 的第三方网关 IP，而不是官方 xAI API。没有发现直接恶意载荷或隐藏执行，但数据流和凭据路由明显不可信，整体应判为 SUSPICIOUS。

The code does not show clear malware or intentional sabotage. It is an image-generation API client with significant transport and credential-handling risks: the default endpoint is unencrypted HTTP at a hardcoded public IP, and API-provided download URLs receive the API key without host allowlisting. Use HTTPS, avoid hardcoded public defaults, restrict download hosts, do not send credentials to media URLs, and validate or limit downloaded content. The fragment also appears syntactically incomplete as provided.