image-studio

SUSPICIOUS: the skill’s core purpose is coherent, and its credential/file access is mostly proportionate for image generation, but data flows are less clean than stated because prompts and API keys go through a third-party gateway and an unpublished local wrapper script. This is not confirmed malware, but it carries medium risk due to hidden execution details, temp prompt storage, and indirect provider routing.