sjht-ppt-delivery

Convert HTML slide deck to PDF and send to Feishu user. Use when the user asks to generate a PPT/presentation and deliver it as a PDF file via Feishu message...

This skill appears to do what it says, but it reads your OpenClaw config file (~/.openclaw/openclaw.json) to find Feishu APP_ID/APP_SECRET even though the registry entry declared no required config or env vars. Before installing or running: (1) review ~/.openclaw/openclaw.json contents to ensure it doesn't contain unrelated secrets you don't want read; (2) consider providing FEISHU_APP_ID and FEISHU_APP_SECRET as environment variables instead of relying on the config file, or modify the script to accept explicit credentials; (3) verify the Feishu bot permissions and that the app credentials are scoped appropriately; (4) ensure chromium-browser and global npm packages (puppeteer-core, pdf-lib) are installed in a controlled environment; (5) if you require higher assurance, ask the publisher to update the skill metadata to declare the config path and required credentials, or to accept credentials via parameters rather than reading your whole config file.

Type: OpenClaw Skill Name: sjht-ppt-delivery Version: 1.0.0 The skill bundle contains scripts that perform high-risk operations, specifically reading sensitive credentials from `~/.openclaw/openclaw.json` and uploading local files to the Feishu API (`send_file_feishu.py`). While these actions are aligned with the stated purpose of delivering generated presentations, the capability to access system secrets and exfiltrate data to an external endpoint is inherently risky. Additionally, `html2pdf.cjs` executes a headless browser using the `--no-sandbox` flag, which increases the potential impact of browser-based vulnerabilities.