Slide Maker

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI06: Memory and Context Poisoning

What this means

Presentation topics, draft text, pitch details, or report data typed into the tool may remain on disk and be shown or exported later.

Why it was flagged

The script creates a persistent local data directory and appends user-provided command input to logs/history.

Skill content

DATA_DIR="${HOME}/.local/share/slide-maker" ... echo "$ts|$input" >> "$DATA_DIR/draft.log" ... _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Recommendation

Use with non-sensitive content unless local history retention is acceptable. The publisher should disclose the storage, add opt-in/disable and cleanup controls, and document where data is kept.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or behave differently on systems without Python, and users should treat it as code-backed rather than purely instructional.

Why it was flagged

The artifact includes runnable shell code that invokes Python even though the registry requirements declare no required binaries and there is no install spec.

Skill content

python3 << 'PYEOF'

Recommendation

Declare the runtime dependency and entrypoint clearly, or keep the skill truly instruction-only.