poster generator

Generate professional marketing posters, social media graphics, and event flyers using AI-driven templates, customizable text, colors, and batch output in PN...

This skill plausibly implements a poster generator, but there are some red flags you should act on before installing: - Metadata mismatch: the registry lists no required binaries, but the docs require Node.js >=18 and npm packages. Treat the docs as authoritative only after you inspect the code. - Inspect the source: review the GitHub repository (package.json, index/CLI entry, and any postinstall scripts) for network calls, eval/exec usage, or unusual postinstall behavior before running npm install -g. - Check package.json scripts: watch for postinstall, preinstall, or install scripts that run arbitrary commands with your privileges. - Run in a sandbox: if you're unsure, run the tool inside a container or VM, or use npx to avoid global installation. - Watch native modules: canvas/sharp/jimp are native or binary-compiled modules that may require build tools and run native code during install — ensure you trust the package source. - Verify the claim of 'local processing': search the code for axios/fetch/http calls to confirm whether assets or data are sent to external servers. - Avoid providing secrets: the skill does not need API keys for basic features, so do not supply credentials unless you confirm they are necessary and trustworthy. - Use standard safety checks: run `npm audit`, check maintainer reputation, read recent commits, and prefer installing from an official, well-maintained package or verified repository. If you can provide the repository/package.json or the package code, I can scan the scripts and dependencies for risky install-time behavior or network calls to give a higher-confidence assessment.

Type: OpenClaw Skill Name: poster-generator Version: 1.0.1 The bundle contains metadata and documentation for an AI-powered poster generation tool. The files (skill.md, readme.md, and _meta.json) describe a legitimate utility for creating marketing materials using libraries like canvas and sharp. There is no evidence of malicious code, data exfiltration, or harmful prompt injection; the instructions provided to the AI agent are strictly aligned with the tool's stated purpose. While the documentation includes a promotional link to an 'Official Support Partner' on Xianyu, this appears to be a legitimate support channel rather than a security threat.