omnicaptions-transcribe

SUSPICIOUS: the stated capability matches a transcription skill, and the Gemini API key requirement is proportionate, but the trust model is weakened by installing an unpinned CLI from an extra package index outside the default registry and then passing that CLI an API key. No clear malicious exfiltration is shown, yet the external package source and credential forwarding create medium-high supply-chain risk.