newpaper

将学术论文 PDF 自动转换为 PowerPoint 海报（PPTX）和 HTML 文件。支持 UniAPI、MiniMax 等 OpenAI 兼容 API。

Before running this skill, review and reduce risk: 1) Inspect the GitHub repository (https://github.com/caoxinran102-sys/Paper2Poster) manually — do not blindly run the clone+install steps. 2) Do NOT clone into your current working directory with '.', instead clone into a dedicated empty folder so existing files cannot be overwritten. 3) Run the code in an isolated environment (container/VM) or at minimum a dedicated conda environment to contain side effects. 4) Review requirements.txt and repository code for any network/exfiltration behavior before pip installing; prefer pinned, audited dependencies. 5) Use least-privilege API keys (create a dedicated key with limited scope/quotas) and avoid storing long-lived secrets in plaintext; consider using ephemeral or restricted keys and remove .env after use. 6) If you are unsure about the repo's trustworthiness, run the pipeline on a local, offline model or skip running remote code entirely. These steps will materially lower the risk of accidental data exposure or system modification.

Type: OpenClaw Skill Name: newpaper-skill Version: 1.0.0 The skill bundle instructs the agent to clone a repository from a personal GitHub account (caoxinran102-sys/Paper2Poster) rather than the official organization repository (Paper2Poster/Paper2Poster) mentioned in the README. It explicitly directs the agent to solicit sensitive credentials (OPENAI_API_KEY) from the user and store them in a .env file before executing arbitrary Python code from the cloned repository. This pattern of using a non-official fork to handle user secrets and execute code is a high-risk indicator of a potential supply chain attack, although no explicit exfiltration logic is present in the provided files.