Pitch Deck Visuals

Investor pitch deck structure with slide-by-slide framework, visual design rules, and data presentation. Covers the 12-slide framework, chart types, team sli...

This skill is coherent with its goal (it uses a rendering service to make slide images), but it asks you to install and log into a third-party CLI via a curl|sh installer and to execute code/images remotely. Before installing: 1) verify the domain (inference.sh / dist.inference.sh) and review the install script and checksums yourself; 2) understand that any slide content or Python code you send will be transmitted to that service (check their privacy/terms); 3) prefer downloading releases from a known release host or inspecting the binary and checksum locally rather than piping to sh; 4) if you cannot or do not want to share slide content externally, consider generating images locally (matplotlib, Puppeteer, wkhtmltoimage) instead. Because the skill instructs an external install/login that are not declared in metadata, treat it with caution.

Type: OpenClaw Skill Name: pitch-deck-visuals Version: 0.1.5 The skill is classified as suspicious due to the use of high-risk capabilities, even though the provided examples are benign. Specifically, the `SKILL.md` instructs the agent to install the `inference.sh` CLI using `curl -fsSL https://cli.inference.sh | sh`, which is a direct execution of remote code and poses a significant supply chain risk. Additionally, the skill leverages `infsh/python-executor` to run arbitrary Python code, which, despite being used for benign data visualization in the examples, represents a powerful code execution capability that could be exploited if the agent were prompted with malicious input. The broad `Bash(infsh *)` permission further contributes to the elevated risk profile.