image-generation

SUSPICIOUS. The skill’s stated purpose and API credential needs are mostly coherent for image generation, and no obvious exfiltration proxy or remote installer is present. The main concern is trust in the bundled CLI: it is the component that receives API keys and project image inputs, yet its provenance and release history are not verifiable from the provided skill content. Automatic invocation without explicit user request also broadens agent behavior beyond a purely on-demand helper.