Ruiguan Copyright

What to check before installing: - Be aware the skill sends the image URL and parameters to an external service at tool-gateway.linkfox.com (and has a separate feedback endpoint at skill-api.linkfox.com). Any image URL you provide will be transmitted to that service — avoid private/internal URLs or images containing sensitive data. - The included script and API docs require an environment variable LINKFOXAGENT_API_KEY (used in the Authorization header). The skill metadata does not declare this; confirm you trust the API provider and understand where to obtain/store the key before supplying it. - Confirm the provider/domain (tool-gateway.linkfox.com) is legitimate for your organization and review their privacy/data-retention and legal terms if you will submit user images. - If you need stronger assurance, ask the author for a homepage or publisher identity, request that the skill manifest be updated to declare LINKFOXAGENT_API_KEY in requires.env, and verify any service endpoints and credential issuance process. Why I rated this suspicious: the implementation matches the claimed purpose, but the omission of the required API credential in the declared metadata is a non-trivial inconsistency that affects security review and user expectations. If the manifest explicitly declared the API key requirement and the provider identity were clear, this would likely be classified as benign. Additional information that would raise confidence: an explicit requires.env listing LINKFOXAGENT_API_KEY, a verified homepage or publisher, and documentation on data handling by the external API.