threejs-image-generator

SUSPICIOUS: the stated purpose and requested Gemini credential are broadly coherent, and the intended data flow appears to be to Google's official API. However, the skill's actual execution relies on unverifiable local scripts from this and another skill bundle, with no visible code, pinning, or integrity controls; this raises moderate supply-chain and execution-trust risk rather than clear maliciousness.