vi-mockup

SUSPICIOUS. The core mockup purpose is coherent and the local script execution is proportionate, but the skill’s optional `GPTIMAGE_BASE_URL` design and explicit recommendation of `tryallapi.com/v1` route API keys, prompts, and reference images through a non-official third-party gateway. That is not enough to call malware, but it is a meaningful credential-forwarding and data-flow risk for an otherwise benign design skill.