pp-openrouter-image

SUSPICIOUS. The skill is not clearly malicious and the installer appears same-org and documented, but its real footprint is broader than its image-focused description, it relies on mutable external CLI installs, forwards API keys to that CLI, supports transitive MCP installation, and can POST outputs to arbitrary webhooks. These are proportionate for a powerful automation CLI but elevate security risk beyond a narrowly scoped image helper.