Security audit
goai-ppt-gen
Security checks for vulnerabilities and agentic risk
Overview
The skill's requirements, scripts, and instructions are consistent with its stated purpose (generating PPTs via the GoAI/PPT service) and request only the API key and typical tooling needed to upload references and download the generated file.
This skill appears to do what it says: it will upload any local reference images or PDFs you pass (or drag into the chat) to the GoAI PPT service (BASE_URL defaults to https://ppt.mustgoai.com) and then download and open the generated .pptx. Before installing or running: 1) only provide files you are comfortable sharing with mustgoai.com (attachments and local reference files are uploaded), 2) keep your GOAI_API_KEY secret and only supply a key from a trusted account on mustgoai.com, 3) consider setting GOAI_BASE_URL if you need to point to a different/trusted endpoint, and 4) verify that mustgoai.com and the demo link are trusted (note the SKILL.md uses an http:// URL in instructions for obtaining a key — prefer https when possible). If you need stronger guarantees, inspect the full common.sh for any additional file reads or behavior not shown in the truncated preview before use.
Static analysis
No suspicious patterns detected.