ppt-skill2

触发关键词：演示、PPT、幻灯片、slides、presentation、keynote、deck、汇报、展示; 使用场景：用户需要生成演示文稿、汇报材料或教学幻灯片。

This skill appears to be what it says (Reveal.js slide scaffolding), but there are practical and supply‑chain concerns you should address before running it: - Prerequisites not declared: The SKILL.md and scripts call node and use npm packages (cheerio, puppeteer). The package.json included does not list these dependencies and the skill metadata lists no required binaries. Ask the author for an explicit prerequisites list (Node version, npm, required packages) or avoid running the scripts until dependencies are pinned and install steps are provided. - Puppeteer and headless Chromium: check-overflow.js launches Puppeteer (headless browser) to load local HTML and CDNs. Running it will execute remote JS/CSS loaded from CDNs in a headless browser — run in an isolated environment (container or VM) and avoid running as root. - Unpinned CDN/plugin usage: Generated HTML pulls libraries from jsdelivr/cdnjs and uses a reveal.js plugin URL with '@latest'. That is a supply‑chain risk; prefer pinned versioned URLs and/or vendored copies you audit. - Missing dependency declarations: Either the skill should include a package.json with dependencies or provide installation instructions (npm install) and a lockfile. Without that, you may end up installing packages from npm unexpectedly. - Package metadata: package.json publishConfig points to an internal registry (contextlab.alibaba-inc.com). This is not necessarily malicious but unusual; confirm origin/trust of the skill author. Recommendations: request a clear install/usage README from the author, ensure dependencies are declared and pinned, review the scripts yourself (they are short and readable) or run them inside a sandbox/container, and avoid executing them on sensitive hosts or with elevated privileges until you confirm the dependency and CDN choices.

Type: OpenClaw Skill Name: ppt-skill Version: 1.0.4 The skill bundle provides a framework for generating Reveal.js presentations but includes several Node.js scripts (create-presentation.js, check-overflow.js, and check-charts.js) that perform high-risk operations. Specifically, create-presentation.js allows for arbitrary file writing, and check-overflow.js utilizes Puppeteer for browser automation to load local files via 'file://' URLs. These scripts lack input sanitization for file paths, which constitutes a significant vulnerability that could be exploited to read or overwrite sensitive system files if the AI agent is manipulated. The SKILL.md instructions explicitly direct the agent to execute these local scripts and external commands like 'npx decktape'.