Most AI slide makers give you pictures of slides or text boxes dropped on a page. PPT Master aims for a real PowerPoint file: slide masters, native shapes with working handles, charts and tables backed by data, transitions and animations, so you can click anything and carry on editing it by hand. You hand your AI coding tool a PDF, a document or a topic, it confirms the purpose, audience and design with you, then builds the deck on your machine and exports a .pptx.
It is built by Hugo He, a finance professional who regularly reviews decks, and has about 74,000 stars, 28 contributors and 38 releases since December 2025, the latest being v6.8.0. It can also fill your own .pptx template while keeping its design, and add narration from the speaker notes, using Microsoft Edge's online voices by default. The narration can use a voice you have already cloned at a provider such as ElevenLabs, but that is a side feature and the docs say to clone only voices you own or have permission to use.
It is a workflow rather than an app, and the README is honest about the trade-offs: it uses a lot of tokens, you pay for them, and a cheap model gives visibly worse decks. Expect to polish the result rather than get a finished deck in one go.
- Repository: github.com/hugohe3/ppt-master
- Licence: MIT (MIT License)
- Language: Python. Stars: 74.4K. Forks: 5,830. Last push: Nov 6, 2026.
- Scan: safe, Nov 7, 2026, commit 7695473
Who it is for
Consultants, analysts and anyone else who turns documents into decks and needs the result to stay editable in PowerPoint. You do not write code, but you do install Python and run an AI coding tool such as Claude Code or Cursor, and you pay for the model.
Getting started
1. Get the project and its dependencies (Python 3.10 to 3.14)
git clone https://github.com/hugohe3/ppt-master.git && cd ppt-master && pip install -r requirements.txt2. Or install only the skill into your agent, then run pip install -r requirements.txt from where it landed
npx skills add hugohe3/ppt-master3. Open the folder in your AI tool and ask in chat
Please create a PPT from projects/q3-report/sources/report.pdfAPI keys for optional image, search and voice services go in a .env file. The README's sponsor links are referral links. You can use any provider you already have.
Safety scan
We cloned hugohe3/ppt-master at commit 7695473 on Nov 7, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits, no binaries, no install hooks and no installer scripts in 13,171 files. Most of that file count, 12,035 files, is SVG icons.
- 3 pattern hits, all explained. skills/ppt-master/scripts/server_common.py:75 runs PowerShell with an encoded command, but only under WSL on Windows, and only to open the preview page in your default browser; the encoding keeps the URL from being read as code. The second hit is one test of that same line, and the third is a 9,843-character line of chart styling XML in chartex.py.
- The word sponsor appears 34 times in the README. The paid sponsors are Kimi and four API resellers: PackyCode, APIKEY.FAN, RunAPI and ModelGo, with referral links, and APIKEY.FAN and RunAPI advertise prices as low as 7% and 10% of official rates. Using one means your documents pass through that reseller on the way to the model. We did not test them, and for private documents we would use the model provider directly.
- To its credit, the sponsorship stops at the docs: SKILL.md tells the agent to read the sponsor file only when you ask for a provider recommendation, and never to bring it up during normal work. PPT Master runs with whichever agent and model you already have.
- Voice cloning does not happen inside the tool. You clone a voice in the provider's own console and pass in its ID; the docs say PPT Master never uploads your sample. Default narration does send your speaker notes to Microsoft's online Edge voices, so skip narration for confidential notes.
- When fetching a web page, source_to_md/web_to_md.py uses the curl_cffi library to imitate Chrome's connection fingerprint, to get past sites such as WeChat articles that block scripts. It is an optional convenience and not something the project advertises. All 25 bare-IP URLs are test values such as 8.8.8.8, in two security test files.
- No lockfile, so we could not check known vulnerabilities: dependencies are version ranges and you get whatever is current on the day. No GitHub Actions workflows at all, so no CI in the repo. It has a security policy, licence and contributing guide; no Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 3 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | No GitHub Actions workflows. |
| Network hosts | 40 distinct hosts referenced from source; most often example.invalid, api.minimax.io, example.gov.tw, page.example. 25 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (3)
| Where | Rule | Match |
|---|---|---|
| skills/ppt-master/scripts/server_common.py:75 | powershell-encoded | [powershell, '-NoProfile', '-NonInteractive', '-EncodedCommand', command], |
| skills/ppt-master/scripts/svg_to_pptx/native_objects/chartex.py:274 | very-long-line | 9843 chars |
| skills/ppt-master/scripts/tests/test_preview_browser.py:47 | powershell-encoded (test/example) | args[:4], ['/windows/powershell.exe', '-NoProfile', '-NonInteractive', '-EncodedCommand'], |
URLs to bare IP addresses (25)
By the numbers
| Stars | 74.4K |
|---|---|
| Forks | 5,830 |
| Contributors | 28 |
| Commits | 2,273 |
| Open issues | 1 |
| Open pull requests | 0 |
| Releases | 38 |
| Latest release | v6.8.0 |
| Licence | MIT |
| Main language | Python |
| Project age | 11 months |
| Last push | Nov 6, 2026 |
| Tracked files | 13,171 |
| Lines of code | 287.6K |
| Checkout size | 76 MB |
Lines by language: Python 215.5K, Markdown 36.9K, JSON 24.2K, JavaScript 8,352, CSS 2,264, HTML 219.
Questions
Is PPT Master free?
The tool is free and MIT-licensed, with no subscription. You pay for the AI model, and the README warns that this approach uses a lot of tokens because it designs page by page. Image generation and premium voices cost extra if you turn them on.
Are my documents kept private?
The pipeline runs on your machine, but your material goes to whichever AI model you use, plus any search, image or speech service you enable. Choose the provider with that in mind, and be wary of low-cost API resellers for anything confidential.
Do I need to know how to code?
No coding, but it is not a one-click app. You install Python, run one pip command and use an AI coding tool's chat window. The project has a step-by-step guide for Windows.
Is it a voice cloning tool?
No. It makes slide decks. Narration is optional, and a cloned voice is an extra you set up at a provider such as ElevenLabs and then point it at. The docs say to clone only voices you own or have permission to use.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.