slides-generation-skills
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: slides-generation-skills Version: 1.0.0 The skill bundle's Python scripts (`generate_slides.py`, `get_job_status.py`, `search_themes.py`) correctly read the `SLIDES_2SLIDES_API_KEY` environment variable and use it to make authenticated HTTP requests to the `https://2slides.com/api/v1` endpoint, which is the stated purpose of the skill. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or obfuscation. The `SKILL.md` provides clear, purpose-aligned instructions to the AI agent without any prompt injection attempts to subvert its behavior or access unrelated sensitive data. The `mcp-integration.md` describes an optional integration method using `npx` to run a remote package, which is a general supply chain consideration for any `npx` usage, but is not directly executed by the skill's core scripts or instructed to the agent within its primary workflow.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can use the user's 2slides API access to create presentations and consume account credits.
The skill requires an account API key even though registry metadata lists no required environment variables or primary credential; this is expected for the service, but it grants access to the user's 2slides account and credits.
Users must have a 2slides API key ... Store the key in environment variable: `SLIDES_2SLIDES_API_KEY`
Set the API key only when you intend to use the service, keep it private, and monitor 2slides usage/credits.
Text, document summaries, and reference-image information used for a deck may be processed by 2slides.
User-provided slide content is transmitted to the 2slides API; reference-image mode also sends a reference image URL or base64 data. This is purpose-aligned but is an external provider data flow.
API_BASE_URL = "https://2slides.com/api/v1" ... payload = { "userInput": user_input, "themeId": theme_id, ... }Do not use this skill with confidential documents or images unless you are comfortable sharing that content with 2slides under its terms.
Using large page counts or high-resolution settings may spend more of the user's 2slides credits.
Generation options can consume paid service credits, especially higher-resolution or multi-page reference-image generation. The cost is disclosed and aligned with the skill purpose.
1K/2K: 100 credits per page - 4K: 200 credits per page
Confirm page count, resolution, and mode before generating expensive decks.
If the optional MCP integration is configured, a local npm package may be downloaded and run.
The optional MCP setup runs an npm package that is not pinned in the provided artifact. This is optional and purpose-aligned, but users should verify the package source before using it.
"command": "npx", "args": ["2slides-mcp"]
Verify the 2slides MCP package provenance, consider pinning a trusted version, and use the direct Python scripts if you do not need MCP integration.