image-generation

SUSPICIOUS. The skill’s purpose is legitimate and its requested access is mostly proportionate, but it depends on unspecified MCP server implementations for Ideogram and Luma and forwards API keys into that code. Because those servers are not verified as official, the install path and credential flow create a significant supply-chain and credential-forwarding risk even without clear evidence of malicious intent.