Sum2Slides Lite

对话总结成专业PPT，支持纯本地处理和可选飞书上传 (v1.1.6)

This package appears to implement what it claims: a local PPT generator with an optional Feishu uploader. Before installing: 1) review the code (especially platforms/feishu/feishu_platform.py) to confirm you understand where network calls occur; 2) run the included INSTALL_VERIFICATION.py, quick_permission_check.py, and simple_sum2slides_test.py inside an isolated test directory; 3) keep feishu.enabled=false and do not set FEISHU_APP_ID/FEISHU_APP_SECRET unless you trust the package and want upload functionality; 4) prefer manual copy or symlink installation (as documented) instead of any automated installer. I give medium confidence because many files were truncated/omitted for review — if you want a higher-confidence assessment, provide the omitted files (or search them for exec/eval/dynamic network endpoints and unexpected credential accesses).

Type: OpenClaw Skill Name: sum2slides-lite Version: 1.1.6 The skill bundle is classified as suspicious due to the use of risky automation techniques, potential injection vulnerabilities, and evidence of security flag evasion. Specifically, `core/wps_generator.py` executes AppleScript via `subprocess.run` using unsanitized string interpolation for user-provided content, making it vulnerable to AppleScript injection. Furthermore, `setup_info.py` explicitly describes methods to bypass security system flags (e.g., `[LOCAL_INSTALLER_EXECUTION]`) by avoiding standard installation scripts. The bundle also employs 'security theater' by including over a dozen redundant verification scripts and documentation files (such as `INSTALL_VERIFICATION.py` and `SECURE_INSTALLATION_GUIDE.md`) which, while appearing to enhance safety, are often used to socially engineer users or agents into executing code under a false sense of security.