goose-graphics

SUSPICIOUS: the skill’s graphics-generation behavior is mostly aligned with its purpose, but the install path depends on an unverified third-party CLI and package setup not substantiated by publisher evidence here. No clear credential harvesting or exfiltration is shown, so this looks more like medium supply-chain risk than malware.