sketch-to-diagram

SUSPICIOUS. The skill’s purpose is coherent, but its core workflow depends on a likely third-party image-recognition MCP that receives both sensitive image data and vendor API credentials. That credential forwarding and indirect data path are not fully consistent with the claim that images go only to official vision APIs, so the main concern is supply-chain and data-flow trust rather than overtly malicious behavior.