Yummy Gen Image

This skill appears to do what it says (run yummycli to generate/edit images via Gemini), but there are a couple of things to check before installing: - Confirm the install behavior: SKILL.md contains an npm install for @yummysource/yummycli, but the registry metadata claimed there was no install spec. Ask the publisher which is authoritative and inspect the npm package contents (or the package's repository) before running install. - Verify the package source and maintainership (@yummysource scope). If you can't inspect it, consider running in a sandboxed environment or container. - Ensure the GEMINI_API_KEY you supply has appropriate, minimal permissions and rotate it if you later remove the skill. Understand that local image files passed as --input-image will be read and likely uploaded to Gemini by the CLI. - Check and test the related yummy-shared skill: the skill asks that it be applied first; review it for any additional env vars or behaviors. If the registry metadata is corrected (explicitly lists GEMINI_API_KEY in required env vars and documents the npm install) and you audit the npm package, the remaining footprint looks proportionate. If you cannot verify the package or the metadata mismatch isn't explained, avoid installing or run it in a restricted sandbox.