bananahub

SUSPICIOUS: the skill’s image-generation capabilities generally match its stated purpose, but its footprint includes notable trust and data-flow risks: API keys may be sent to arbitrary compatible endpoints, remote templates can be installed from repo targets, and telemetry/network destinations are not fully disclosed here. This looks more like a high-risk multi-provider integration than confirmed malware.