Gamma Presentations
v1.0.0Create presentations, documents, social posts, and websites using Gamma's AI API. Use when asked to create slides, presentations, decks, documents, or web content via Gamma.
⭐ 1· 2.3k·10 current·10 all-time
by@mrgoodb
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md and description match (calling Gamma's API to generate presentations/documents/web pages). However the instructions require an API key (GAMMA_API_KEY) while the skill metadata declares no required environment variables or config paths — the skill's declared requirements do not match what it actually needs to operate.
Instruction Scope
Runtime instructions tell the agent to look for an API key in the environment ($GAMMA_API_KEY) or in TOOLS.md and to POST/poll the Gamma public API. Asking the agent to read or store secrets in TOOLS.md is out-of-band relative to the declared metadata and grants the agent a path to persistent storage of credentials that isn't documented in the registry.
Install Mechanism
There is no install spec and no code files — the skill is instruction-only, so nothing is written to disk by an installer. This is the lowest install risk.
Credentials
The instructions require a single API key (GAMMA_API_KEY), which is reasonable for the stated purpose, but the fact that the registry lists no required env vars is inconsistent. Additionally, suggesting putting the key in TOOLS.md (a persistent file) is disproportionate and risky for secret handling unless clearly documented and secured.
Persistence & Privilege
The skill does not request always:true and has no install, but the guidance to add the API key to TOOLS.md effectively asks for persistent storage of credentials outside the declared config. That increases the blast radius if the file is accessible to other skills or processes.
What to consider before installing
This skill appears to do what it says (call Gamma's public API) but its metadata omits the fact that it needs a GAMMA_API_KEY and it tells the agent to look in or write to TOOLS.md. Before installing or using it: (1) do not store secrets in shared files like TOOLS.md unless you control who can read them — prefer ephemeral environment variables or a secrets manager; (2) ask the publisher to update the skill metadata to declare GAMMA_API_KEY and any config paths so you can review required privileges; (3) verify the API base URL and the developer/source (there is no homepage listed); (4) only provide an API key with the minimum scope required and be cautious about letting the agent autonomously access persistent keys. If you cannot confirm the publisher or the missing metadata, treat this skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk97a4kxzwg4he8jgzyq8v2q1ax804q1v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.