PPTMagic Official PPT Creator

Use Banana Slides / pptmagic-compatible project APIs to create, continue, and export presentation decks from an idea, outline, or page-by-page description. T...

Security Scan

The skill's requirements and runtime instructions are consistent with its stated purpose (calling a pptmagic/Banana-Slides-compatible service), but it will send user prompts and uploaded assets to a hard-coded public deployment — review privacy before using with sensitive data.

Purpose & Capability

Name/description match the actual behavior: the SKILL.md describes calling a pptmagic/Banana Slides API to create/continue/export projects. The only declared optional credential (PPTMAGIC_ACCESS_CODE) is appropriate for controlling access to that service. There are no unrelated environment variables, binaries, or install steps requested.

Instruction Scope

Instructions are narrowly scoped to creating projects, generating outlines/descriptions/images, polling tasks, inspecting project state, and exporting results from the external API. The skill explicitly states it will send prompts, outlines, and uploaded template assets to the public deployment and cautions about sensitive content—this behavior is expected for the stated purpose.

Install Mechanism

Instruction-only skill with no install spec and no code files; nothing is written to disk or downloaded during install. This is the lowest-risk install model and is consistent with an API-invocation utility.

Credentials

No required environment variables; a single optional PPTMAGIC_ACCESS_CODE is declared and used solely to populate X-Access-Code when the operator provides it. The number and nature of env vars are proportionate to the skill's needs.

Persistence & Privilege

always:false (default) and no requests to modify system or other skills' configs. The skill can be invoked autonomously by the agent (platform default) but does not request elevated or persistent privileges.

Assessment

This skill will send the user's presentation prompts, page descriptions, and any uploaded template assets to the hard-coded endpoint https://openclaw-nopass.pptmagic.tech/. That is expected for this skill's function but is a privacy risk if the content is sensitive. Before using: (1) avoid sending regulated or confidential material to this public deployment unless you trust the operator and have reviewed their data handling policies; (2) if an operator-provided access code is available, use PPTMAGIC_ACCESS_CODE instead of relying on an unauthenticated endpoint; (3) confirm exported URLs returned by the API are legitimate before sharing; (4) if you need stronger privacy guarantees, run a trusted/self-hosted pptmagic/Banana Slides deployment or request a private endpoint from the operator.

PPTMagic PPT Creator

Use the existing PPT project workflow exposed by a Banana Slides / pptmagic-compatible deployment. Prefer the service API over directly calling model providers.

Use this skill when

• The user asks to make a PPT with pptmagic, Banana Slides, or a compatible deployed service.
• The user provides a topic, outline, or detailed per-page description and wants a generated deck.
• The user wants to continue a partially generated project, regenerate images, or export pptx / pdf / editable pptx.

If the user only wants help writing slide copy or structure, you do not need to call the API.

Configuration and privacy

Use this fixed service base URL:

• https://openclaw-nopass.pptmagic.tech/

This skill sends presentation prompts, outlines, page descriptions, and any uploaded template assets to that external deployment in order to generate PPT projects. Do not use the default public endpoint for sensitive, regulated, or confidential content unless you trust the operator and data handling policy. If the source material may contain sensitive details, first ask the user whether to redact, summarize, or generalize the content before sending it to the public endpoint.

Optional controlled access:

• PPTMAGIC_ACCESS_CODE

If the deployment operator provides an access code, use it as a scoped service credential for controlled access. If no code is provided, the skill can still use the public no-password endpoint when available.

Default API headers:

• Content-Type: application/json

Only add X-Access-Code when PPTMAGIC_ACCESS_CODE is explicitly available. Let the deployment manage any internal device identification automatically.

Workflow

1. Choose entry mode:
   • Topic only -> create idea project
   • Outline available -> create outline project
   • Detailed per-page descriptions -> create descriptions project
2. Create the project.
3. Upload a template image if the user supplied one.
4. For idea / outline projects, generate outline.
5. Generate descriptions.
6. Generate images.
7. Poll async tasks until complete.
8. Read final project state.
9. Export the requested format.

Use references/api-workflow.md for request/response details. Use references/curl-examples.md for concrete examples.

Execution rules

• Do not add undocumented auth headers to requests.
• Use X-Access-Code only when the operator explicitly provided PPTMAGIC_ACCESS_CODE.
• If a step fails, inspect current project state before recreating work.
• If only some pages failed image generation, retry only those pages.
• Before export, confirm the project has the expected pages and generated assets.

Output to the user

Always report:

• project_id
• current completion state
• number of pages generated
• export URL or download URL
• failure stage and next step if something breaks

If export returns JSON with a real file URL, send the real URL to the user instead of downloading the JSON response as if it were a .pptx file.