product-image

SUSPICIOUS. The skill's purpose, API key requirement, and Ofox data flow are broadly coherent for product-image generation, and no direct exfiltration or stealth behavior is evident. The main security issue is transitive trust: it depends on and may instruct installation of another skill that handles execution and credentials, so the overall footprint is larger than this SKILL.md alone suggests.