gpt-image

SUSPICIOUS: the core image-generation behavior is coherent, but the skill frames itself as 'OpenAI GPT Image API' while routing prompts, images, and credentials through Pixazo's third-party gateway, and it stores the API key locally in a raw file. The wildcard transitive skill-install instruction adds additional trust-chain risk. Not confirmed malware, but the credential/data routing is not fully aligned with the branding and should be treated as medium risk.