md-to-nanobanana-ppt

将Markdown分析报告转换为完整PPT：先提供5种以上配色方案供用户选择，再拆分为不超过20张幻灯片，生成对应的 nano-banana 图片提示词，调用 nano-banana2-apiyi 出图，最后合成 `.pptx` 并按文件大小分流交付。当用户需要把 Markdown 报告转成 PPT、从现有报告生...

This skill mostly does what it says (MD → PPT with AI images), but it expects to call external services (nano-banana2-apiyi), send progress to Feishu, and use an email-sending skill — yet it declares no API keys or webhooks. Before installing/use, ask the publisher to: (1) list all required credentials and endpoints (nano-banana API key(s), Feishu webhook/token, email-mail-master configuration/QQ credentials); (2) explain where and why files are written (confirm or change the hard-coded ~/.openclaw/media/... path); (3) describe what data is sent to external services and obtain explicit consent for sending report content to third-party image-generation APIs; (4) confirm whether the platform will supply any implicit credentials or if the user must provide them; and (5) verify the trustworthiness and scope of the email-mail-master skill. If the developer cannot provide clear answers or if you cannot supply/inspect the required credentials, do not enable this skill, or run it only in a tightly controlled sandbox with network access restricted to known endpoints.

Type: OpenClaw Skill Name: md-to-nanobanana-ppt Version: 1.0.0 The skill 'md-to-nanobanana-ppt' is classified as suspicious because it utilizes high-risk capabilities including shell command execution, network access, and file system operations, which are identified as suspicious indicators in the review criteria even when plausibly needed for the task. Specifically, SKILL.md instructs the agent to execute shell commands (e.g., 'stat' or 'python3 -c') for file size checks and to invoke an external script ('email-mail-master') for delivery, which involves handling user email addresses. While the behavior is aligned with the stated purpose of converting Markdown to PPT, these capabilities represent a significant attack surface for potential exploitation.