video-generation

SUSPICIOUS. The skill’s purpose and high-level capabilities mostly align, and using provider API keys from the environment is proportionate for video generation. However, it instructs the agent to execute a local script without inspecting it, so the actual credential and data flows are unverifiable from the skill text alone. The MiniMax endpoint guidance is also inconsistent with the provider’s common official API host, adding moderate uncertainty. This is not confirmed malware, but it carries meaningful execution- and data-flow trust risk.