mm-output

Parse PDF/Markdown files into structured HTML posters with multi-modal output (PDF, PNG, DOCX, PPTX), or generate poster/slides images via Gemini image gener...

This package looks functionally consistent with a poster/slide generator that uses LLMs and Gemini-style image APIs, but there are several red flags you should check before installing or running: 1) The registry lists no required environment variables, yet the code and SKILL.md expect API keys (OpenAI / RUNWAY / IMAGE_GEN / TEXT_MODEL). Do not supply keys until you confirm which are actually required. 2) Inspect files that call external services (paper2slides/image_generator.py, mm_output/integrate.py, renderer_unit.py) to see exact HTTP endpoints and what data is sent. The example .env contains non-public domains (runway.devops.rednote.life, runway.devops.xiaohongshu.com) — confirm those endpoints are trusted. 3) install.sh will run apt-get and download/install tools (UV, Python 3.12, Playwright). Run it only in an isolated environment (container or VM) and review the script first. 4) The repo contains hard-coded example test paths referencing internal network mounts — ignore or update those before running tests. 5) If you must try it, run in a disposable container, do not expose real API keys (use limited-scope/test keys), and review the network calls (e.g., with a proxy) to ensure no unexpected exfiltration. If you want, provide the contents of paper2slides/image_generator.py and mm_output/integrate.py and I can check exactly which endpoints and parameters the code posts so you can judge trustworthiness.

Type: OpenClaw Skill Name: mm-output Version: 1.0.1 The skill bundle is a legitimate and highly functional tool for converting PDF and Markdown documents into multi-modal outputs like HTML posters, PDFs, PNGs, and PPTX slides. It utilizes standard industry libraries such as marker-pdf for parsing, Playwright for browser-based rendering, and python-docx/python-pptx for document generation. While the installation script (install.sh) requires root privileges to install system dependencies (fonts and Chromium libraries) and the code interacts with external LLM APIs (OpenAI and Gemini), all behaviors are strictly aligned with the stated purpose. No evidence of data exfiltration, credential theft, or malicious prompt injection was found.