Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
GoAI PDF to PPT
v1.0.1Convert PDF documents to PowerPoint presentations via GoAI API. Use when the user asks to convert PDF to PPT, turn a PDF into slides, make a presentation fro...
⭐ 0· 40·0 current·0 all-time
by@goai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, required env var (GOAI_API_KEY), required binary (uv), and the code (upload + convert + download via https://ppt.mustgoai.com) align with a PDF→PPT conversion skill. The only minor inconsistency is a version label mismatch in the registry metadata (registry shows 1.0.1 vs. project files showing 0.3.0), which looks like packaging/versioning noise rather than malicious behavior.
Instruction Scope
SKILL.md and agents/openai.yaml are explicit and constrained: they instruct the agent to invoke the Python entrypoint through uv, upload a local PDF (if given) to the GoAI service, poll for job completion, and return a local path + public URL. This stays within the conversion scope. Important privacy note: the skill requires printing the absolute local path of the generated PPT in plain text (MEDIA/RESULT_PATH) which can reveal local filesystem structure; it will also upload the user's provided local PDF to the provider. If you want to avoid exposing filenames/paths or sending sensitive PDFs to an external service, do not use the skill.
Install Mechanism
No custom download/install URL is used by the skill; it is instruction-and-Python-code-based and declares 'uv' as the runtime helper. 'uv' may create a local venv and install httpx or download a Python runtime on first run — that behavior is documented in SKILL.md and implemented via bootstrap.py. This is a standard, explainable approach and not a hidden remote install.
Credentials
Only GOAI_API_KEY is required (primary credential). The skill optionally reads GOAI_BASE_URL if set. No unrelated secrets or multiple unrelated credentials are requested. The code does reference the user's home path to show an example config path in an error message, but it does not read or exfiltrate other local configuration files.
Persistence & Privilege
always:false and no evidence the skill modifies other skills or system-wide agent settings. It does network calls to the stated service (ppt.mustgoai.com) and will be invoked autonomously by agents if allowed — this is the platform default and not a unique privilege for this skill.
Assessment
This skill appears to do what it says: it uploads a PDF (if you supply a local file) to the GoAI PPT service, waits for conversion, downloads the PPT, and prints both the local filepath and public URL. Before installing or running it consider: 1) Privacy: local PDFs are uploaded to https://ppt.mustgoai.com (or GOAI_BASE_URL if overridden). Do not use it with sensitive or confidential PDFs unless you trust the service. 2) Filesystem exposure: the skill prints absolute local file paths in its output (this may reveal directory structure); if that is a concern, avoid using it. 3) API key: you must provide GOAI_API_KEY—treat this key like any other API secret and only grant it to services you trust. 4) Runtime: the skill requires 'uv' which may create a local virtualenv and install Python/dependencies on first run; this is described in SKILL.md. 5) Refund/credits behavior: SKILL.md describes automatic refunds and a demo PPT URL on insufficient credits; these are behavioral guarantees from the provider—verify them with the provider if you rely on credits. If you need higher assurance, review the provider's privacy/terms and consider testing with non-sensitive PDFs first.Like a lobster shell, security has layers — review code before you run it.
latestvk97akky051nbvfhwkc47898pe583se72
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📄 Clawdis
OSmacOS · Linux · Windows
Binsuv
EnvGOAI_API_KEY
Primary envGOAI_API_KEY