Slides Generator

Create Hummingbot-branded PDF slides from markdown with Mermaid diagram support. Use for presentations, decks, and technical documentation with professional...

This skill likely performs the claimed slide generation, but exercise caution before running it. Specific recommendations: - Do NOT run the curl | bash command without inspection. Instead, inspect the script text first or use the local scripts/generate_slides.sh included with the skill package. - Prefer running the script in an isolated environment (container or VM) or a Python virtualenv and use npm with --location=project or --user equivalents to avoid global installs. - The script will automatically run pip3 install fpdf2 (no --user) and may invoke npx to pull mermaid-cli — these change your system and could run arbitrary code. Consider manually installing verified dependencies from trusted sources. - If you must use the remote URL, verify it points to a pinned commit or release (not just raw/master) and review the script content for unexpected network calls or command execution. - If you need stronger assurance, ask the skill author for a signed release, a reproducible package, or a versioned GitHub release instead of executing raw content from the web. - If you are not comfortable auditing shell/Python scripts, avoid running this skill on sensitive hosts.

Type: OpenClaw Skill Name: slides-generator Version: 1.0.0 The skill is classified as suspicious due to several high-risk behaviors. Firstly, the `SKILL.md` instructs the agent to download and execute a script from a remote GitHub URL (`curl -s https://raw.githubusercontent.com/... | bash`), posing a significant supply chain risk if the remote repository is compromised. Secondly, the `scripts/generate_slides.sh` script accepts `--input` and `--output` file paths directly from user input (via the agent) without sufficient sanitization, creating critical arbitrary file read and write vulnerabilities. A malicious prompt could instruct the agent to read sensitive system files or write to arbitrary locations (e.g., `/etc/cron.d/`). Lastly, `SKILL.md` instructs the agent to translate user-provided natural language descriptions into Mermaid code, creating a prompt injection surface where a malicious user could attempt to trick the agent into generating harmful code or commands.