AIスライド作成ワークフロー

AIを使った資料作成ワークフロー。Gemini Gem × Claude Code × Slidevでプロ級スライドを作る。AI感を徹底排除するための鉄則を含む。コムギさんが「資料を作りたい」「スライド作って」と言ったら必ずこのスキルを使う。GemのURLを先に案内してからSTEP1に入ること。

Before installing or using this skill: (1) be aware the SKILL.md hard-codes a specific user home (/Users/meruemu/...) and a Google Drive folder ID — replace these with safe, generic placeholders or confirm they match your environment; (2) the script invokes a local claude CLI at an exact path and passes --dangerously-skip-permissions — do not run that flag unless you understand its implications and trust the binary; (3) the instructions reference an example secret (GOG_KEYRING_PASSWORD) and an account (GOG_ACCOUNT) but the skill does not declare required credentials — verify where and how secrets will be provided and stored; (4) the workflow writes files, runs a local http.server, and uploads/shares to Drive/Telegram — consider running in a sandbox or VM and review any files before upload; (5) ask the skill author to: remove hard-coded paths and IDs, declare required env vars, explain the use of --dangerously-skip-permissions, and provide a non-user-specific example; (6) if you plan to allow autonomous invocation, lock down which tools the agent may call (or require manual approval) because this skill assumes access to local executables and external services.

Type: OpenClaw Skill Name: slide-creator Version: 1.1.0 The skill bundle is classified as suspicious primarily due to multiple potential shell injection vulnerabilities in `SKILL.md`. User-provided input for `<資料名>` (document name) is directly interpolated into shell commands (e.g., `mkdir -p "$WORK"`, `cd .../<資料名>/dist`, `.../<資料名>.pdf`, `/tmp/<資料名>.zip`) without apparent sanitization, creating a risk of arbitrary command execution. Additionally, the skill uses the `--dangerously-skip-permissions` flag with the `claude` tool, hardcodes a password (`openclaw_gog_2026`) for Google Drive access, and explicitly shares generated files publicly on Google Drive, posing data leakage risks.