dmxapi-image-recognition

The SKILL.md describes a CLI wrapper for DMXAPI (image description, OCR, chart analysis, etc.), which is coherent with the stated purpose. However the registry metadata claims no required binaries or env vars while the instructions explicitly require Node.js 20+, installing dmxapi-cli, and setting an API key — this mismatch is unexpected and incoherent.

Instructions tell the agent/user to convert local images to base64 and upload them (or pass remote URLs) to DMXAPI. That is expected for an image-recognition skill, but it also means local files (including PII like ID cards) will be transmitted off-machine. The SKILL.md does not ask to read other unrelated files or secrets, but it does instruct persistent CLI configuration of an API key.

There is no formal install spec in the registry, yet SKILL.md tells users to run `npm install -g dmxapi-cli`. A global npm install executes unvetted package install scripts and grants the package filesystem/exec capabilities on the host. Because the package and its origin are not validated in the metadata (no homepage/source provided), this raises installation risk.

The registry lists no required environment variables or primary credential, but the runtime instructions require configuring an API key (`dmxapi config set apiKey sk-your-api-key`). That mismatch is problematic: the skill will store and use a service credential but does not declare it in metadata, preventing automated permission review. Requesting a single API key is reasonable for the described functionality, but it must be declared and verified.

The skill is not marked always:true and does not request elevated platform privileges. However, the CLI step `dmxapi config set apiKey ...` will persist the API key in the user's dmxapi CLI config (local persistence) and a global npm install will write files system-wide. These behaviors are normal for a CLI tool but were not declared in the registry metadata.