Skill Ppt Builder

Build high-quality presentation decks from scratch. Covers the full lifecycle from brainstorming through content writing, visual design, AI image generation,...

Key things to consider before installing or running this skill: - It sends your slide text/prompts to external image-generation services (Ofox / OpenRouter). Do NOT feed it confidential content unless you accept that it will be transmitted to those providers. - The registry metadata does NOT declare required API keys, but the bundled script expects OFOX_API_KEY or OPENROUTER_API_KEY. The error message in the script incorrectly references IMAGE_API_KEY; this mismatch is a bug and a source of confusion. - The top description claims 'No external SaaS dependency' which is false given the network calls — treat that claim as incorrect. - Review scripts/generate_deck.py before use (endpoints, model names, and the logic that builds prompts). Consider running in a sandboxed environment, with test/pool API keys that have strict billing limits. - If you want to avoid exfiltration of sensitive text, either remove/modify the code that sends full content to remote APIs, sanitize prompts, or run a local image model instead. - If you proceed, set API keys as separate, least-privilege credentials for image-generation only, and monitor usage/billing and network traffic. If you want, I can: extract the exact lines that reference env var names and endpoints, suggest a minimal patch to make env var usage and error messages consistent, or produce a checklist to safely test the skill in an isolated environment.

Type: OpenClaw Skill Name: ppt-builder Version: 1.4.0 The 'ppt-builder' skill bundle provides a comprehensive workflow for generating PowerPoint presentations using AI. It includes a Python script (scripts/generate_deck.py) that performs external network requests to AI image generation APIs (api.ofox.ai and openrouter.ai) and utilizes the local file system to store images and assemble PPTX files. While these capabilities are plausibly required for the stated purpose and no clear evidence of malicious intent or data exfiltration was found, the bundle is classified as suspicious due to the presence of high-risk behaviors such as external network access, environment variable reading (API keys), and instructions for shell command execution in SKILL.md.