gpt-image-2-skill

SUSPICIOUS. The skill’s stated image-generation purpose matches its API key use and file handling, and there is no clear credential exfiltration or off-platform data routing beyond OpenAI. The main issue is install trust: it asks users/agents to execute unpinned code directly from a personal GitHub repo, with a mild publisher/source mismatch, so risk is driven by supply-chain exposure rather than confirmed malicious behavior.