ni-poster

SUSPICIOUS: The skill's stated purpose matches poster generation, and there is no direct evidence of credential theft, exfiltration endpoints, or malicious payloads. However, its runtime-agnostic design delegates execution to unspecified local, MCP, or third-party image tools, including a named unofficial GitHub example, creating medium supply-chain and trust-boundary risk disproportionate to a tightly scoped skill.