Presentation Agent

Convert Markdown documents to presentation slides (PDF/PPTX/HTML) using Marp. Supports Mermaid diagrams (gantt, flowchart, etc.) and data graphs. Use when a...

This skill appears to do what it says (convert Markdown to slides using Marp and mermaid-cli). Before installing or running, consider: - Ensure marp (marp-cli) and mmdc (mermaid-cli) are available on the host PATH; the scripts assume these binaries exist. - The SKILL.md contains strong visual/style rules (use Mincho fonts, no emoji, logo absolute path, font sizes) that are not reflected in theme/frexida.css or md2slide.sh. If these rules are important, you should modify frexida.css and/or md2slide.sh to implement them (for example, change font-family, update logo size/path, or add the CSS-generation step mentioned). - The script writes temporary files under /tmp and removes them on success; if you handle sensitive content, test how temporary files are handled on failures and whether remnants remain. - The marp invocation uses --allow-local-files which is required to load local CSS/images but does give the marp process access to local paths referenced by the theme; ensure any referenced local files (e.g., logo path) are intended. - The bundled tailwind JS file is large and included in the package; if supply-chain trust is a concern, replace it with a vetted copy or verify its origin. If you want to be extra cautious: run the scripts in a sandboxed environment (container) the first time, and review/adjust frexida.css to match your typography and logo requirements.

Type: OpenClaw Skill Name: presentation-agent Version: 1.0.0 The skill bundle is classified as suspicious because the script `scripts/md2slide.sh` executes the Marp CLI with the `--allow-local-files` and `--html` flags, as explicitly mandated by the design rules in `SKILL.md`. These flags allow the rendering engine to access and embed arbitrary local files from the host environment, creating a significant Local File Inclusion (LFI) vulnerability if the input Markdown content is maliciously crafted (e.g., using HTML iframes to read `/etc/passwd`). While these settings are likely intended to facilitate the use of local fonts and the brand logo, they pose a high risk of data leakage from the agent's execution environment.