article-batch-illustration

SUSPICIOUS. The skill’s purpose mostly matches its capabilities and it calls Google’s official Gemini API directly, but it forwards the API key into an unprovided custom Python script and writes back to local documents. The main risk is credential handling and unverifiable local wrapper behavior, not confirmed malicious exfiltration.