md-to-modern-pptx

The package documentation and scripts (as described) implement a reasonable workflow for Markdown→PPTX with optional image generation. No direct malicious code is visible in the provided fragment. The primary security concern is intentional design to forward prompts and API keys to a configurable gateway (GEMINI_BASE_URL + GEMINI_API_KEY), which, if misconfigured or malicious, enables credential theft and prompt/content exfiltration. Additional moderate risks: unpinned dependency installs and recommendation of a global .env. Actionable advice: only configure trusted gateway endpoints, prefer per-project .env, pin dependencies/lockfiles, and review the actual .js/.py scripts for unexpected file or network operations before use in sensitive environments.

No direct evidence of embedded malware, obfuscation, or remote code-execution/backdoor behaviors in the provided documentation. The primary security concern is legitimate feature-driven network exfiltration risk: slide content and API credentials are sent to any CHERRY_BASE_URL the user configures. That makes correct configuration and secret handling critical. Recommendations: only configure trusted gateways; add explicit warnings to avoid committing .env files and to set restrictive permissions; consider supporting secret managers or prompting for ephemeral credentials at runtime; add validation/pinning of allowed gateway domains and explicit logging of outbound endpoints for auditability.