gpt-imagegen

BENIGN with medium security risk. The skill’s capabilities mostly match its stated image-generation purpose, uses local scripts, and includes sensible HTTPS/URL safety checks. The main concern is data-flow integrity: it accepts arbitrary 'OpenAI-compatible' API base URLs and forwards the API key there, and the example uses an unrelated third-party domain. That is suspicious design for credential routing but not enough to classify as malicious from the visible skill text alone.