slides-generation-skills

What to consider before installing/using this skill: 1) Coherence: The skill appears to do what it claims — its scripts only call 2slides API endpoints and require a single API key (SLIDES_2SLIDES_API_KEY). That is internally consistent. 2) Origin: The package/source is listed as unknown and there is no homepage. If you plan to provide an API key, prefer code from a known/trusted source or inspect the files locally before running them. 3) API key handling: The skill expects you to set SLIDES_2SLIDES_API_KEY in your environment. Do not paste your API key into publicly readable files or share it. The MCP guide suggests putting the key in a URL query string (https://.../api/mcp?apikey=KEY) — avoid that if possible because query-string keys can leak in logs and process listings. Prefer storing the key in a shell environment or a secrets manager and passing it to local processes securely. 4) Run in a safe environment first: If you are unsure about the origin, run the Python scripts in a sandbox or isolated environment and review network traffic to confirm they only talk to 2slides.com. The code is readable and not obfuscated, so a quick code review will surface unexpected behavior. 5) Least privilege & monitoring: Use a dedicated 2slides API key with minimal permissions if the service supports that, and monitor API usage/credits after first use in case of accidental misuse. 6) Document handling: If you use the document summarization feature, the agent or scripts will need access to the document contents; do not submit sensitive documents unless you accept sending their content to the 2slides service. If you want, I can: (a) produce a short checklist to safely test this skill locally, (b) highlight exact lines in the scripts that perform network access, or (c) suggest secure ways to configure MCP integration that avoid embedding keys in URLs.