freeimg-z-image

SUSPICIOUS. The core capability matches the stated purpose and the intended API target appears to be official Gitee AI, so this is not fundamentally incompatible with an image-generation skill. The main concern is install and execution trust: the skill is distributed from an unpinned personal GitHub repository through a skills CLI flow, and it collects a real API token that is forwarded to repo-provided code not included here. That makes the skill moderately risky from a supply-chain and credential-forwarding perspective, even without direct evidence of malicious exfiltration.