blog-image-generator

SUSPICIOUS: The core capability matches the stated image-generation purpose and calls the official Google API directly, but the skill improperly exposes a Gemini API key and instructs use of a local secrets file. Main risk is credential handling, not malware or supply-chain abuse.