Gemini TG Image Gen

This skill appears to implement what it claims, but there are important issues to consider before installing: - Metadata mismatch: The skill will fail without OPENROUTER_API_KEY, but that env var is not declared in the skill metadata. Only set that API key if you trust the skill and the OpenRouter account. - Network risk: The script downloads whatever URLs are returned by OpenRouter. If an attacker or an unexpected response supplies a URL, the agent will fetch it (possible SSRF or access to internal resources). Consider running this in a network-restricted sandbox or adding URL host validation/allowlist. - Dependency note: The script requires Python and the requests library; the skill does not declare those requirements. Ensure your runtime provides them. - Code issues: There's a bug in _extract_image_urls (uses an undefined b64_json variable) that may raise an exception; you may want to inspect/fix the script before use. Recommendations: - Ask the publisher to update the registry metadata to declare OPENROUTER_API_KEY as a required credential and list runtime dependencies. - Prefer running the skill in an isolated environment (no access to internal networks) and/or modify the script to validate/whitelist image hosts and limit timeouts/response sizes. - Review or test the script locally first. If you don't trust the source, avoid providing your OpenRouter API key.