Gamma App API
Security checks across malware telemetry and agentic risk
Overview
This Gamma API skill is purpose-aligned, but its script builds Python code from unescaped user inputs, which could let a crafted prompt or option run unintended local code.
Review or fix the script before using it with copied or untrusted text. If you proceed, store GAMMA_API_KEY securely, understand that prompts go to Gamma and may consume account credits, and choose sharing/export options deliberately.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A malicious or copied prompt/option could make the skill run unintended local Python commands on the user's machine instead of only creating Gamma content.
The script builds a Python program by interpolating user-controlled arguments such as prompt text and options directly into source code. Crafted quote sequences can change the Python code instead of being safely JSON-encoded as data.
PAYLOAD=$(python3 -c "... 'inputText': '''${INPUT_TEXT}''' ... if '${TONE}': text_opts['tone'] = '${TONE}' ...")Do not pass untrusted text through this script as-is. The publisher should pass values to Python via argv, stdin, or environment variables and JSON-encode them as data, with validation and tests for quotes and newlines.
Actions run through this skill are performed under the user's Gamma account and may consume Gamma credits or reveal workspace folder/theme information returned by the API.
The skill uses the user's Gamma API key to authenticate API calls. This is expected for the stated integration, but it gives the script authority to create Gamma content and use account credits.
-H "X-API-KEY: ${GAMMA_API_KEY}"Use a revocable, least-privileged API key if Gamma supports it, keep the key out of logs and shared shells, and rotate it if exposed.
Any confidential text, image URLs, or business details included in a prompt will be sent to Gamma's servers.
The artifacts clearly disclose that prompts and the API key are sent to the Gamma provider API, which is purpose-aligned but important for privacy decisions.
Your API key and inputText content are sent to Gamma's servers.
Avoid including sensitive or regulated content unless Gamma's terms, retention, and access controls meet your needs.