jimeng-skill

SUSPICIOUS. The skill’s behavior matches its stated Dreamina generation purpose, and the installer appears related to the vendor, so this is not confirmed malware. However, it relies on an unpinned pipe-to-shell installer and an external CLI binary that handles authentication and media generation without visible checksum/signature verification, creating meaningful supply-chain and credential-forwarding risk.