slidev
“Create and present web-based slidedecks for developers using Slidev with Markdown, Vue components, code highlighting, animations, and interactive features. Use when building technical presentations, conference talks, code walkthroughs, teaching materials, or developer decks.”
references
aipkg.jsonLICENSE.mdLICENSE.txtREADME.mdreferences/animation-click-marker.mdreferences/animation-drawing.mdreferences/animation-rough-marker.mdreferences/api-slide-hooks.mdreferences/build-og-image.mdreferences/build-pdf.mdreferences/build-remote-assets.mdreferences/build-seo-meta.mdreferences/code-groups.mdreferences/code-import-snippet.mdreferences/code-line-highlighting.mdreferences/code-line-numbers.mdreferences/code-magic-move.mdreferences/code-max-height.mdreferences/code-twoslash.mdreferences/core-animations.mdreferences/core-cli.mdreferences/core-components.mdreferences/core-exporting.mdreferences/core-frontmatter.mdreferences/core-global-context.mdreferences/core-headmatter.mdreferences/core-hosting.mdreferences/core-layouts.mdreferences/core-syntax.mdreferences/diagram-latex.mdreferences/diagram-mermaid.mdreferences/diagram-plantuml.mdreferences/editor-monaco-run.mdreferences/editor-monaco-write.mdreferences/editor-monaco.mdreferences/editor-prettier.mdreferences/editor-side.mdreferences/editor-vscode.mdreferences/layout-canvas-size.mdreferences/layout-draggable.mdreferences/layout-global-layers.mdreferences/layout-slots.mdreferences/layout-transform.mdreferences/layout-zoom.mdreferences/presenter-notes-ruby.mdreferences/presenter-recording.mdreferences/presenter-remote.mdreferences/presenter-timer.mdreferences/style-direction.mdreferences/style-icons.mdreferences/style-scoped.mdreferences/syntax-block-frontmatter.mdreferences/syntax-frontmatter-merging.mdreferences/syntax-importing-slides.mdreferences/syntax-mdc.mdreferences/tool-eject-theme.mdSKILL.mdSYNC.md- 01SDI-285%MEDIUM
references/code-import-snippet.md:49
detailhide
The Monaco Write feature allows direct file modification through the presentation interface without explicit user consent or access controls. In a collaborative or untrusted environment, this could enable unintended modifications to source files referenced in the presentation, potentially affecting project integrity and introducing malicious changes through a presentation vector.
47```4849## Monaco Write5051Link editor to file for live editing:fix Implement explicit user confirmation dialogs before enabling write mode. Add optional authentication/authorization checks tied to file permissions. Consider restricting monaco-write to explicitly whitelisted files only. Document the security implications prominently and require opt-in configuration rather than inline syntax.
- 02SQP-290%HIGH
references/code-import-snippet.md:49
detailhide
The {monaco-write} syntax silently enables live file editing without any warning, confirmation prompt, or audit trail. An attacker could embed malicious write operations in shared presentations, or a user could accidentally enable editing on sensitive files. This creates a supply-chain risk vector where presentations become attack surfaces for file manipulation.
47```4849## Monaco Write5051Link editor to file for live editing:fix Require explicit confirmation UI before any write operations occur. Implement comprehensive audit logging of all file modifications. Add a requirement for users to explicitly opt-in to write features via configuration rather than per-snippet syntax. Consider restricting monaco-write to a separate, sandboxed environment isolated from actual project files.
- 03SQP-285%MEDIUM
references/diagram-plantuml.md:22
detailhide
The skill documents using an external PlantUML service (https://www.plantuml.com/plantuml) by default without warning users that diagram data will be sent to a third-party server. This creates privacy risks where sensitive diagram content (architectural details, internal process flows, etc.) could be exposed. Users may not realize their presentation content is being transmitted externally.
20## Server Configuration2122Default: Uses https://www.plantuml.com/plantuml2324Custom server in headmatter:fix Add a clear security notice in the documentation warning users about external service transmission. Recommend users configure a self-hosted PlantUML server for sensitive content. Include steps for local deployment or provide a default fallback that doesn't transmit data externally. Add a privacy note in the headmatter examples explaining the data transmission implications.