free-vision

The skill is mostly aligned with its stated image-analysis purpose, and its image-to-provider data flow is openly documented. The main risks are external image upload, reliance on an external CLI/package, and transitive skill installation/update instructions; these make it suspicious from a security posture standpoint, but not clearly malicious.

This module is a standard installer/configurer with user-space file writes and shell alias setup. It does not show direct in-script malware behavior (no obfuscation, no eval/command injection, no explicit exfiltration). The primary risk is supply-chain trust: it installs an external npm package globally without version pinning or integrity verification and allows install-time lifecycle execution, then runs the installed CLI (optionally `doctor`). Treat it as high supply-chain exposure and review/pin/verify the npm dependency and lock the installation process for safer usage.