Skills open-show

📦

open-show

Name: open-show
Author: lumacoder

Content revision r1 High Risk 🌐 Network access⚙️ External commands📁 Filesystem access

Convert Documents Into HTML Slides

Teams often need quick presentations from articles, reports, and notes. OpenShow converts common document formats and URLs into a single playable HTML slideshow.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "open-show" from https://skillstore.io/skills/lumacoder-open-show.md and its manifest at https://skillstore.io/api/skills/lumacoder-open-show/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/lumacoder-open-show.md Signed manifest GET /api/skills/lumacoder-open-show/manifest Signed lockfile GET /api/skills/lumacoder-open-show/lockfile

Test it

Using "open-show". A Markdown planning note is converted into a deck.

Expected outcome:

A single HTML file is created with section-based slides, navigation controls, and a timer.

Using "open-show". A trusted web article is converted for a team briefing.

Expected outcome:

The main article content becomes a slide deck with images inlined when downloads succeed.

Using "open-show". A PDF handout is converted for classroom display.

Expected outcome:

Each PDF page is embedded as an image slide in one playable HTML file.

Security Audit

High Risk

v4 • 7/6/2026 Open versioned report

No prompt-injection language was found in SKILL.md or README.md. Confirmed risks are arbitrary URL and image fetching, a TLS verification bypass fallback, DOCX media reads without size limits, and unsafe preservation of untrusted HTML in generated decks. Most other static alerts are false positives from Markdown backticks, documentation URLs, keyboard event code, CSS, and documented .hermes paths.

Files scanned

1,344

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/openshow.py:151-154 scripts/openshow.py:823-867

Untrusted Markup Preserved in Generated HTML

HTML and Markdown input blocks are stored as raw HTML and then inserted into the generated deck. A malicious source can preserve event handlers, unsafe links, or unescaped text that executes when the output file is opened.

The code builds Block.html from raw node contents and concatenates those strings into final HTML. Scripts are removed earlier, but attributes and unescaped text are not sanitized.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/openshow.py:286

Python HTTP libraries

r = requests.get(url, headers=headers, timeout=20, verify=False)

The fallback request explicitly uses verify=False, disabling TLS certificate validation. This can allow man-in-the-middle content injection into generated slides.

Medium

scripts/openshow.py:78

Python HTTP libraries

r = requests.get(src, timeout=15)

This fetches remote image URLs from source content and inlines the response bytes. It can make outbound requests to arbitrary hosts selected by input content, so the network exposure is real.

Medium

scripts/openshow.py:281

Python HTTP libraries

r = requests.get(url, headers=headers, timeout=20)

This fetches a user-provided URL with requests.get. It is an intended feature, but it can reach arbitrary destinations from the user environment and should be controlled.

Medium

scripts/openshow.py:237

Python archive libraries

docx_zip = zipfile.ZipFile(path)

This opens a user-supplied DOCX zip and reads embedded media into memory without visible size limits. It does not extract files, but crafted archives can still cause resource exhaustion.

Risk Factors

🌐 Network access (7)

README.md:54 README.md:59 README.md:157 scripts/openshow.py:78 scripts/openshow.py:281 scripts/openshow.py:286 SKILL.md:23

⚙️ External commands (46)

📁 Filesystem access (15)

scripts/openshow.py:926 scripts/openshow.py:235 scripts/openshow.py:237 SKILL.md:42 SKILL.md:47 SKILL.md:52 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:42 SKILL.md:47 SKILL.md:52 SKILL.md:125 SKILL.md:126 SKILL.md:127

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/lumacoder-open-show/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/lumacoder-open-show/security.svg)](https://skillstore.io/skills/lumacoder-open-show?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/lumacoder-open-show?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lumacoder-open-show/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/lumacoder-open-show.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

lumacoder. (2026). open-show security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/lumacoder-open-show/audits/4

BibTeX citation

@techreport{lumacoder-lumacoder-open-show-2026,
  author = {lumacoder},
  title = {open-show security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/lumacoder-open-show/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "open-show security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "lumacoder"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/lumacoder-open-show/audits/4"
identifiers:
  - type: other
    value: "skillstore:lumacoder-open-show:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prepare Meeting Briefings

Convert Markdown notes or a DOCX report into slides for fast internal review.

Teach From Source Material

Turn PDF handouts, text outlines, or web articles into a classroom deck.

Share Technical Summaries

Create a portable HTML deck from project documentation or release notes.

Try These Prompts

Create a Basic Deck

Use open-show to convert notes.md into a playable HTML slideshow in ~/openshow_outputs.

Convert a Report

Use open-show to convert the DOCX project report into an HTML deck and tell me the output path.

Build From a Web Article

Use open-show to convert this article URL into a single-file HTML presentation, then summarize any extraction limits.

Generate and Open a Deck

Use open-show to convert this PDF, save it to ~/openshow_outputs, and open the generated deck only after confirming with me.

Best Practices

Review the generated slides before presenting them.
Use trusted URLs and documents, especially when opening generated HTML.
Keep source files small for reliable conversion and portable output.

Avoid

Do not use sensitive or untrusted documents without reviewing the output.
Do not expect pixel-perfect extraction from complex web pages.
Do not use it as a PPTX editor or full design suite.

Frequently Asked Questions

What formats does OpenShow support?

It supports Markdown, DOCX, PDF, TXT, local HTML, and HTTP or HTTPS URLs.

Does it require internet access?

Local files do not require internet access. URL conversion and remote image inlining require network access.

Can it create PowerPoint files?

No. It creates a playable HTML slideshow, not a PPTX file.

Where are slides saved?

The command writes the generated HTML file to the output directory supplied by the user.

Does it work on mobile?

Yes. The generated deck includes responsive layout and touch navigation.

Can Claude, Codex, or Claude Code use it?

Yes. The skill metadata lists Claude, Codex, and Claude Code as supported tools.

Developer Details

Author

lumacoder

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/lumacoder/open-show/tree/main/

Ref

b8ca75d2c0a7e7102978993058777d82b8ab2610

Maintenance freshness

7/18/2026

Usage

5 downloads · 116 views

File structure

📁 assets/

📄 logo.svg

📁 scripts/

📄 openshow.py

📄 README.md

📄 SKILL.md