gpt-image-2-gen

SUSPICIOUS: The core purpose and required credential are mostly coherent for an image-generation skill, and the distribution appears same-org. The main concerns are third-party API routing through EvoLink instead of direct official OpenAI endpoints, an arbitrary callback sink, and reliance on an unseen shell script that receives the API key. This looks more like a medium-risk proxy integration than confirmed malware.

No strong indicators of overt malware are present in this fragment. The primary security concerns are (1) dynamic execution via spawnSync with an embedded API key in an inline -e JavaScript string (potential injection/safety risk) and (2) optional persistence of the full API key into shell startup files in plaintext. The network activity shown is limited to a legitimate key verification endpoint, but the local secret-handling and dynamic execution patterns warrant review and safer implementation.