slides-generation-skills

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can use the user's 2slides API access to create presentations and consume account credits.

Why it was flagged

The skill requires an account API key even though registry metadata lists no required environment variables or primary credential; this is expected for the service, but it grants access to the user's 2slides account and credits.

Skill content
Users must have a 2slides API key ... Store the key in environment variable: `SLIDES_2SLIDES_API_KEY`
Recommendation

Set the API key only when you intend to use the service, keep it private, and monitor 2slides usage/credits.

What this means

Text, document summaries, and reference-image information used for a deck may be processed by 2slides.

Why it was flagged

User-provided slide content is transmitted to the 2slides API; reference-image mode also sends a reference image URL or base64 data. This is purpose-aligned but is an external provider data flow.

Skill content
API_BASE_URL = "https://2slides.com/api/v1" ... payload = { "userInput": user_input, "themeId": theme_id, ... }
Recommendation

Do not use this skill with confidential documents or images unless you are comfortable sharing that content with 2slides under its terms.

What this means

Using large page counts or high-resolution settings may spend more of the user's 2slides credits.

Why it was flagged

Generation options can consume paid service credits, especially higher-resolution or multi-page reference-image generation. The cost is disclosed and aligned with the skill purpose.

Skill content
1K/2K: 100 credits per page
- 4K: 200 credits per page
Recommendation

Confirm page count, resolution, and mode before generating expensive decks.

What this means

If the optional MCP integration is configured, a local npm package may be downloaded and run.

Why it was flagged

The optional MCP setup runs an npm package that is not pinned in the provided artifact. This is optional and purpose-aligned, but users should verify the package source before using it.

Skill content
"command": "npx", "args": ["2slides-mcp"]
Recommendation

Verify the 2slides MCP package provenance, consider pinning a trusted version, and use the direct Python scripts if you do not need MCP integration.