brand-logo-kit

SUSPICIOUS. The core image-generation behavior is consistent with the stated purpose, and the documented package install path looks ordinary. However, the skill's automatic discovery of API keys from other installed skills and caching of those keys outside the repo is disproportionate for a logo tool and creates unnecessary credential-handling risk. Routing prompts and reference images through OpenRouter is disclosed but adds third-party data exposure. This looks like an overreaching skill rather than confirmed malware.