gpt-image

SUSPICIOUS. The skill’s image-generation purpose is plausible, but its actual footprint depends on a third-party `vg` CLI and proxy platform instead of direct OpenAI APIs. That creates a trust and data-flow mismatch: user prompts, local images, and auth all transit through an intermediary whose provenance is not established here. This is not confirmed malware, but it is a meaningful credential-forwarding and supply-chain risk for a skill framed as OpenAI image generation.