icon-designer-generator

SUSPICIOUS: The skill’s image-generation purpose broadly matches its API usage, but trust boundaries are unclear. It requires a gateway credential, forwards it to both a remote API and an npm CLI, and routes user content through multiple domains with ambiguous publisher relationships. This is more consistent with a hosted third-party service integration than a self-contained skill, so the main concern is credential and data-flow exposure rather than confirmed malware.