ppt-creator

Key points to consider before installing or invoking this skill: - Credential requirement (metadata mismatch): The package metadata did not declare any required environment variables, but the code requires an API key (YOO_AI_API_KEY) or config.json.API_KEY. You will need to provide a Yoo‑AI API key for it to work; do not assume it runs fully offline. Prefer creating a scoped/test key for this skill rather than reusing high‑privilege credentials. - External network calls: The skill calls https://saas.api.yoo-ai.com for creating tasks, polling status, getting editor/download URLs, and downloading assets. Uploaded/parsed content (file contents, project summaries) will be transmitted to that service. Only send non-sensitive data or run in an environment where you accept sending that data to the provider. - Local file access and scanning: The skill will read any local files you explicitly provide and can scan a project_path you point it at (analyzeProject recursively inspects directories). Do not point it at repositories or paths that contain secrets, keys, or private data you don't want sent to an external service. - Files written locally: It creates .tasks.json in the working directory and writes outputs to output_dir (default 'outputs' or as configured in config.json). Be prepared for these files and ensure the runtime directory is appropriate. - Missing resources: The code references references/prompts.md; if this file is absent the skill may throw errors. Test in a controlled sandbox first. - Sanity checks: Review the API host (saas.api.yoo-ai.com) and confirm it's the intended provider. If you trust the provider, restrict the API key scope and run the skill in an isolated environment. If you do not trust the provider, do not supply your keys or sensitive files. - Operational suggestions: Run an initial test with minimal, non-sensitive input to verify behavior. If you plan to use project analysis, create a reduced test copy of the project containing only non-sensitive files. Keep the skill's working directory isolated (sandbox/container) and inspect network traffic if you need to verify exactly what is sent. If you want, I can summarize exactly which functions will transmit which user data to the external API (e.g., createPptTask sends text or custom_data; analyzeProject reads and summarizes files) to help you decide which inputs are safe to provide.