安全扫描
OpenClaw
安全
high confidence该技能的代码、文件和运行指令与其声明的目的(生成主题 .pptx 文件)一致,不请求无关的凭据或系统访问,但依赖 npm 包和可选的图像生成/搜索步骤,建议在运行前审查。
评估建议
该技能看似如其所言,但在运行前请注意:1) 检查依赖项和 postinstall 脚本;2) 在隔离环境中运行 npm install 和管道;3) 确认图像生成/搜索的实现方式和潜在 API 密钥需求;4) 如果非常谨慎,检查脚本中网络端点、exec/child_process 使用和文件系统路径;5) 期待技能在工作目录下写输出文件,避免从敏感系统根路径运行。...详细分析 ▾
✓ 用途与能力
Name/description match the shipped templates, rules, and Node scripts. Required artifacts (HTML templates, manifest, validation/fill/convert scripts) are appropriate and proportional to generating PPTX output.
ℹ 指令范围
Runtime instructions stay within the PPT-generation workflow (create output/, generate content.md, build slides.json, run provided node scripts). They do instruct the agent to call helper tools like generate_image or web_search for some image slots — those are plausible for image acquisition but are not defined in the skill and may cause network/API activity outside the skill. The instructions also require running npm and node scripts (which will execute code in the skill directory).
ℹ 安装机制
No automated install spec is embedded; user is told to run npm install in the skill directory. That is expected but means npm will fetch packages (puppeteer downloads Chromium, etc.). This is normal for Node tools but carries the usual network/third-party-package risk — review package.json and package-lock before installing.
✓ 凭证需求
The skill declares no required environment variables, credentials, or special config paths. The only implied external needs are optional image generation/web search calls (which could require API keys depending on how your agent implements generate_image/web_search), but nothing in the skill asks for unrelated secrets.
✓ 持久化与权限
always is false and the skill does not request elevated or system-wide persistence. It writes files under the project workspace (output/) which is expected for a generator. It does not modify other skills or global configs.
⚠ pptx/scripts/run-pipeline.js:54
Shell command execution detected (child_process).
⚠ pptx/scripts/fill-template.js:9
File read combined with network send (possible exfiltration).
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/21
QoderWork PPT 技能初始发布。- 自动根据用户主题生成 QoderWork 风格演示文稿,匹配 14 种内置模板。- 生成可编辑的 .pptx 文件,包含封面、目录、章节分隔页和内容幻灯片(默认 8-15 幻灯片)。- 自动填充模板,管理内容生成、槽位映射和多媒体。- 包含可恢复的管道:内容/幻灯片结构复用、模板填充、HTML 到 PPTX 转换。- 输出放在项目根 `output/` 目录,包含详细结构和使用说明。
● 无害
安装命令 点击复制
官方npx clawhub@latest install qoderwork-ppt-jack
镜像加速npx clawhub@latest install qoderwork-ppt-jack --registry https://cn.clawhub-mirror.com
技能文档
当用户想要 生成 QoderWork 风格演示文稿 时使用此技能。基于用户的主题和要求,自动生成内容,匹配合适的模板,并输出可编辑的 PowerPoint 文件。
执行流程...
(注意:此部分为简略,完整内容请参考原始文档)数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制