Doc2Slides
v1.0.3Convert documents or text into PDF slide presentations via the Ruyi Converter API at nyoi.io. Use this skill whenever the user wants to create slides, presen...
⭐ 0· 110·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the runtime instructions: the skill uses the nyoi.io Ruyi Converter API to convert text/files to PDF slides. No unrelated binaries, config paths, or credentials are requested.
Instruction Scope
Instructions are focused on the conversion workflow (claim invite code, activate agent, POST execute, poll job, download artifact). Two items to note: (1) the SKILL.md tells the agent to reveal the freshly created API key to the user ('Tell the user the API key'), which exposes a secret into the chat; (2) SKILL.md claims 'Each API call resets the inactivity timer' but the API reference states that GET /api/agent/identity does NOT reset the timer — minor inconsistency. Otherwise instructions do not ask the agent to read unrelated files or environment data.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk or downloaded during install.
Credentials
No declared environment variables or platform credentials are required. The only credential is an API key created via the service's invite/activate endpoints, which is proportional to the described remote API usage. Be aware the skill instructs the agent to disclose that API key to the user.
Persistence & Privilege
Skill does not request 'always: true' or claim system-wide persistence. Autonomous invocation is allowed by default but not combined with broad access. The skill expects an API key to be available for subsequent calls, which implies the platform/agent may need to persist that key between interactions — this is normal but the SKILL.md does not explicitly state how to store it.
Assessment
This skill talks to a third‑party service (https://www.nyoi.io) and will create a temporary agent API key via an invite/activate flow. Consider these points before installing: 1) Privacy — any documents you send will be processed by nyoi.io; do not send highly sensitive data unless you trust that service. 2) API key exposure — the instructions tell the agent to show the API key in chat; if chat history is stored or shared, that key could be visible to others. 3) Artifact links are pre-signed and valid for ~2 hours — the agent will be expected to fetch or forward the PDF to you; ensure your messaging integration handles file attachments securely. 4) Minor inconsistency: SKILL.md and the included API reference differ on whether certain calls reset inactivity timers. If you need stronger guarantees about credential handling or retention, ask the skill author for details or avoid sending confidential files. Overall the skill appears coherent with its stated purpose but review nyoi.io's privacy/security practices before uploading sensitive documents.Like a lobster shell, security has layers — review code before you run it.
latestvk97000ygtk1rk8vqf0dxrhee9s832hpr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.