Gamma

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent Gamma.app API helper that uses a Gamma API key to create user-requested presentations, documents, or social posts, with no artifact-backed malicious behavior found.

This skill appears purpose-aligned and benign. Before using it, make sure you are comfortable sending the requested content to Gamma.app, spending Gamma credits for generation, and storing a Gamma API key in the environment.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Installing and using the skill lets it act through the provided Gamma API key for supported Gamma generation/status actions.

Why it was flagged

The script uses the user's Gamma API key to authenticate to Gamma's public API. This is expected for the stated integration and is not shown being logged or sent elsewhere.

Skill content

-H "X-API-KEY: ${GAMMA_API_KEY}"

Recommendation

Use a Gamma API key intended for this purpose, rotate it if no longer needed, and monitor Gamma account usage.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any content used to generate a deck or document will be transmitted to Gamma, so sensitive or confidential material may leave the local environment.

Why it was flagged

User-provided content is sent to Gamma's external API to generate presentations/documents/social posts. The endpoint is disclosed and purpose-aligned.

Skill content

API_BASE="https://public-api.gamma.app/v1.0"

Recommendation

Only send content you are comfortable processing through Gamma.app, and avoid including secrets or unnecessary personal data.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Creating a Gamma generation can consume paid or limited Gamma credits.

Why it was flagged

The skill discloses that generation consumes Gamma credits. This is expected for the purpose, but it is an account-impacting action.

Skill content

Credits are deducted per generation (~150-300 per deck)

Recommendation

Use the skill when you intend to spend Gamma credits, and consider confirming costly or repeated generation requests before running them.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less external provenance information to verify the publisher or upstream project.

Why it was flagged

The registry metadata does not provide an upstream source or homepage. The included script is present and coherent, but provenance is limited.

Skill content

Source: unknown; Homepage: none

Recommendation

Review the included script and install only if you trust the skill publisher and the Gamma API endpoint shown.