Picture it!
Security checks across malware telemetry and agentic risk
Overview
The skill is internally coherent: it is an instruction-only wrapper around the picture-it CLI and requires only Node + picture-it and a FAL API key; the primary risk is that some commands upload user images to fal.ai (and incur cost), which the SKILL.md clearly documents.
This skill appears to do what it says: it runs the picture-it CLI and uses your FAL API key to call fal.ai for generation/editing. Before installing or using it: 1) Confirm the npm package and GitHub repo (https://github.com/geongeorge/picture-it and npm package name) to ensure the code is what you expect; review the package source if you plan to install globally. 2) Understand that generate/edit/remove-bg/upscale will upload user images and prompts to fal.ai and will incur costs; read fal.ai's privacy/retention policy and consider using an API key with limited scope or an expendable key. 3) Prefer storing FAL_KEY in your platform's secret manager rather than pasting into chat; if using CLI auth, the config file is stored at ~/.picture-it/config.json (SKILL.md recommends 0600). 4) Because SKILL.md suggests npm install -g, be aware npm installs can run install scripts — consider installing in an isolated environment or reviewing package scripts first. 5) If you need stricter guarantees about data residency or non-exfiltration, do not use the FAL-backed commands; local-only commands (crop, grade, compose, text) run offline. Overall: coherent and expected behavior, but verify package origin and accept that image uploads and billing are part of its operation.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
VirusTotal findings are pending for this skill version.