ip-scene-poster

SUSPICIOUS. The core poster-generation purpose is coherent and the local script/API-key workflow is plausible, but the skill weakens data-flow integrity by allowing prompts, reference images, and API credentials to be routed through arbitrary OpenAI-compatible gateways, including an explicitly third-party domain (`tryallapi.com`) rather than only official OpenAI endpoints. No evidence of malware, stealth, or destructive behavior is present.