Security audit
Security checks across malware telemetry and agentic risk
The skill is a coherent China-company research workflow, but it needs Review because it embeds and transmits API credentials insecurely and runs external build/helper code during deliverable generation.
Install only if you are comfortable with a review-level skill that contacts external financial/business-data services, reads local OpenClaw credential config, and runs Node/npm build steps. Prefer using it in a sandbox with no unrelated secrets, remove or rotate the embedded Tushare token, require HTTPS for credentialed API calls, and avoid the /tmp DOCX helper override unless you fully control that file.
}, indent=2))
if not (slides_dir / "node_modules" / "pptxgenjs").exists():
print("Installing pptxgenjs...")
r = subprocess.run(["npm", "install", "--omit=dev", "--silent"],
cwd=str(slides_dir), capture_output=True, text=True,
timeout=120)
if r.returncode != 0:# the v0.9.x smoke tests. When the banker workflow stabilises, this will
# move into scripts/ proper — for now we accept a path override via env.
MD_TO_DOCX = pathlib.Path(
__import__("os").environ.get("MD_TO_DOCX_MJS", "/tmp/md_to_docx.mjs")
)if r.returncode != 0:
sys.exit(f"npm install failed: {r.stderr[:500]}")
r = subprocess.run(["node", "compile.js"], cwd=str(slides_dir),
capture_output=True, text=True, timeout=180)
sys.stdout.write(r.stdout)
sys.stderr.write(r.stderr)}, indent=2))
if not (slides_dir / "node_modules" / "pptxgenjs").exists():
r = subprocess.run(["npm", "install", "--omit=dev", "--silent"],
cwd=str(slides_dir), capture_output=True,
text=True, timeout=120)
if r.returncode != 0:r = urllib.request.Request(
"http://api.tushare.pro", data=body.encode(),
headers={"Content-Type": "application/json"}, method="POST")
return json.loads(urllib.request.urlopen(r, timeout=15).read())
def items_to_dicts(resp: dict) -> list[dict]:65/65 vendors flagged this skill as clean.
No suspicious patterns detected.