Investor Relations Manager

This skill is suspicious because its SKILL.md tells you to clone and run an external GitHub project and to provide an OpenAI API key, yet the registry metadata claims no install or credential needs. Before installing, consider: - Inspect the remote repository first: review package.json, postinstall scripts, and all shell scripts (especially agents/ir-cli.sh and scripts/*) for network calls or unexpected behavior. - Verify the repository identity and author (ZhenRobotics / ZhenStaff). Confirm the repo link, commit history, and whether the project is official/trusted. - Prefer pinned, audited dependencies and avoid running npm install directly on unreviewed code. Consider running installation and generation inside an isolated VM or container. - Use a least-privileged OpenAI API key (scoped if possible) and monitor usage; do not reuse a high-privilege key. Consider billing limits or a separate account for testing. - Ask the publisher to update the skill metadata to declare required env vars, source URL, and an install spec (with integrity/pinning). If they cannot or will not, treat the skill as higher risk. - If you must try it, do so in a sandboxed environment, and manually run the scripts after inspection rather than allowing automatic/agent-driven execution. If you want, provide the GitHub repository contents (or a link to the exact repository and commit) and I can point out specific files or lines of concern and give a more definitive assessment.