god-tibo-imagen

SUSPICIOUS. The core image-generation purpose broadly matches the capabilities, and npm/PyPI distribution appears legitimate, but the skill-install instruction is inconsistent with the claimed publisher and introduces third-party transitive trust. Direct reuse of ~/.codex/auth.json and reliance on an undocumented backend also raise meaningful security and data-flow risk.