catime

This skill appears to do what it says (run a CLI, get a GitHub-hosted image URL, send it to the user), but there are two red flags to check before installing: 1) 'uv' binary requirement: The registry lists a required binary named 'uv' but the SKILL.md never mentions it. Ask the owner what 'uv' is for and why it's required. If you can't confirm, don't install in a sensitive environment. 2) Pip package install: The skill recommends 'pip install catime' — pip packages can execute code at install and runtime. Before installing, inspect the package source (PyPI and the linked GitHub repo), look for post-install scripts, network calls, or code that reads unrelated local files. Prefer to: - pip download the package and examine its contents (setup.py/pyproject, entry points, scripts), or - clone the GitHub repository (https://github.com/yazelin/catime as referenced) and review code, or - run the package in an isolated sandbox/container if you must test it. Also verify the image hosting URLs (the examples point to github.com/yazelin/releases/download/...) to confirm they host exactly what you expect and are not redirecting to external trackers. If you need higher assurance, ask the publisher to explain the 'uv' dependency and provide a reproducible installation manifest or signed release. If you cannot validate these points, treat the skill as suspicious and avoid installing it in production or on devices with sensitive data.