Pixcli Skill

This skill appears to be what it claims: a Node CLI that calls a pixcli service and provides Remotion templates. Before installing or running it: - Treat the PIXCLI_API_KEY like any API secret: create a limited key if possible and avoid reusing high-privilege credentials. - Installing via npm (npm install -g pixcli) will pull code from the public registry — review the npm package and its maintainers (and choose npx for one-off use if you prefer not to install globally). - The README mentions an OPENROUTER_API_KEY fallback (not listed in the skill metadata). If you have that env var set, the CLI may use it — consider removing unrelated secrets from your environment when running third-party CLIs. - The Remotion templates included in the bundle will require npm install in a copied folder and then running npx remotion (which executes JS code locally). The templates in this bundle look benign, but review any third-party template code before rendering in a sensitive environment. - If you need higher assurance, inspect the upstream npm package source (pixcli on npm / its GitHub) and the runtime behavior of the CLI (particularly network endpoints and what metadata it sends) before providing any private or sensitive data.