✓
Purpose & Capability
The name/description (SVG/PPT generation) aligns with the shipped files: many SVG templates, tools for PDF→MD, image embedding, SVG postprocessing, and svg_to_pptx. The repository contents are extensive but consistent with a full-featured presentation generation tool.
!
Instruction Scope
SKILL.md and AGENTS.md insist tools be run automatically when a PDF/URL is supplied ("must immediately call" pdf_to_md/web_to_md). That forces network requests and conversion steps without an explicit user confirmation step in the instructions. The workflow also explicitly recommends removing Gemini watermarks using tools/gemini_watermark_remover.py — an action that can implicate copyright/terms-of-service issues. These behaviors are within the domain of a content-generation skill but expand the agent's runtime actions beyond purely local file transforms and could surprise users.
ℹ
Install Mechanism
No install spec (instruction-only skill) — lowest installer risk. However this bundle includes 800+ files and many Python/Node scripts that will be executed locally when invoked. There is no explicit build/install step; user will run local scripts directly. Review the individual tools (especially web_to_md.cjs and gemini_watermark_remover.py) before execution to confirm there are no unexpected network endpoints or destructive actions.
✓
Credentials
The skill requests no environment variables, no credentials, and no config paths. The declared permissions are proportionate to its stated purpose.
✓
Persistence & Privilege
Flags show normal privileges (always:false, model invocation allowed). The skill does not request permanent inclusion or higher-than-normal privileges and does not declare modifying other skills or system settings.
What to consider before installing
This package appears to implement a full offline SVG→PPT workflow and is mostly coherent with that purpose, but review a few risky items before running: 1) Inspect tools/gemini_watermark_remover.py — removing watermarks can violate service ToS or copyright; avoid using it on third-party images. 2) Inspect tools/web_to_md.cjs and web_to_md.py for how they fetch pages (headers, authentication, proxies) before feeding arbitrary URLs — the SKILL enforces immediate conversion of URLs, which will cause outbound network requests. 3) Because there is no install sandbox, run the repo in an isolated environment (container or VM) the first time, and grep for any hardcoded external endpoints, telemetry, or credential usage. 4) If you need stricter controls, ask the maintainer for a minimal subset of scripts you trust (e.g., only svg_to_pptx.py and finalize_svg.py) or request explicit confirmation steps be added to SKILL.md before any network action. If you want, I can (a) list the specific files to audit first, (b) search the repository for network- or OS-level calls to highlight high-risk files, or (c) help craft safe usage guidelines or a sandbox command list.
