officecli-morph-ppt

Generate Morph-animated PPTs with officecli

This skill appears coherent and aligned with its stated purpose, but review the following before use: - Review the install steps in reference/officecli-pptx-min.md: it uses curl to fetch and run an install.sh from raw.githubusercontent.com and queries the GitHub API. Inspect that install.sh on GitHub (and the repo) before running it, or install officecli yourself from a trusted source first. - All helper scripts call the officecli CLI and run local Python/shell commands. Run builds in an isolated workspace or VM if you are cautious, so the scripts cannot affect unrelated files. - The skill does not request any credentials; do not provide secrets to it. If you must grant network access, prefer manually installing officecli and verifying its version instead of letting the skill auto-download. - The SKILL.md already warns not to 'Open with system app' during generation to avoid file locks — follow that guidance. If you want higher assurance: manually inspect the referenced install.sh and the iOfficeAI/OfficeCli GitHub repo, run officecli installation commands yourself, and then run only the local helper scripts from this package.

Type: OpenClaw Skill Name: officecli-morph-ppt Version: 1.0.0 The skill bundle contains instructions in 'reference/officecli-pptx-min.md' (Section 0) that direct the AI agent to perform a 'curl | bash' operation from a remote GitHub repository ('github.com/iOfficeAI/OfficeCli') to install or update a CLI tool every time the skill is used. While this appears intended to ensure the environment is correctly configured for the skill's stated purpose, the practice of downloading and executing remote scripts is a high-risk behavior that could be leveraged for remote code execution or supply chain attacks. Additionally, the heavy reliance on 'subprocess.run' in 'SKILL.md' and 'reference/morph-helpers.py' to execute shell commands based on agent-generated strings creates a potential surface for shell injection vulnerabilities.