poster generator

This skill plausibly implements a poster generator, but there are some red flags you should act on before installing: - Metadata mismatch: the registry lists no required binaries, but the docs require Node.js >=18 and npm packages. Treat the docs as authoritative only after you inspect the code. - Inspect the source: review the GitHub repository (package.json, index/CLI entry, and any postinstall scripts) for network calls, eval/exec usage, or unusual postinstall behavior before running npm install -g. - Check package.json scripts: watch for postinstall, preinstall, or install scripts that run arbitrary commands with your privileges. - Run in a sandbox: if you're unsure, run the tool inside a container or VM, or use npx to avoid global installation. - Watch native modules: canvas/sharp/jimp are native or binary-compiled modules that may require build tools and run native code during install — ensure you trust the package source. - Verify the claim of 'local processing': search the code for axios/fetch/http calls to confirm whether assets or data are sent to external servers. - Avoid providing secrets: the skill does not need API keys for basic features, so do not supply credentials unless you confirm they are necessary and trustworthy. - Use standard safety checks: run `npm audit`, check maintainer reputation, read recent commits, and prefer installing from an official, well-maintained package or verified repository. If you can provide the repository/package.json or the package code, I can scan the scripts and dependencies for risky install-time behavior or network calls to give a higher-confidence assessment.