设计框架套件 - 框架生成器

设计框架自动生成套件（框架生成器）：收到设计需求后自动生成完整设计框架并发送群预览

Security Scan

The skill's instructions call out-of-band scripts and external APIs (OpenRouter, Telegram) and read a config file, but the package supplies no scripts or credentials and declares no required environment variables — the declared purpose doesn't match the actual operational needs.

Purpose & Capability

The description says it will generate design frameworks and send previews to a group, which legitimately requires calling an image-generation API and a messaging API. However, the skill bundle contains no code for those calls and declares no required credentials or config; instead it references an external directory ('design-framework-sender/') and scripts (generate_prompt.sh, send_text.sh, config.py). That mismatch (referencing external scripts and APIs but not declaring/installing them) is incoherent and requires explanation.

Instruction Scope

Runtime instructions tell the agent to run shell commands (mkdir lock, exec bash scripts), extract image attachment paths, call generate_prompt.sh (which calls OpenRouter) and send_text.sh (which sends to Telegram), and read config.py. These instructions access external scripts/configs outside the skill bundle and direct network activity to third-party services; they also instruct silent execution ('no text output'), which increases risk because actions occur without visible logging or confirmation.

Install Mechanism

There is no install spec (instruction-only), which is low disk risk. But the skill depends on an external 'design-framework-sender' installation and scripts that are not included or verified here. The absence of an install mechanism or a declared dependency on that other skill leaves uncertainty about provenance and trust of the external scripts.

Credentials

The instructions clearly require API access (OpenRouter) and a messaging credential (Telegram) but the skill declares no required environment variables or primary credential. It also instructs reading config.py from an external directory; that file likely contains tokens/keys. Requiring access to other files/configs without declaring them is disproportionate and a potential exfiltration vector.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request forced persistent inclusion. The only system write is creating /tmp/design-framework-lock as an atomic lock, which is reasonable for concurrency control. Autonomous invocation is allowed by default but not, by itself, a new concern here.

What to consider before installing

Do not install blindly. Before using this skill, obtain and inspect the referenced 'design-framework-sender' scripts (generate_prompt.sh, send_text.sh, config.py). Verify where API keys (OpenRouter, Telegram) are stored, confirm they are not in world-readable files, and ensure the skill explicitly declares required environment variables. Require the publisher to supply an install spec or source repository for the external scripts and review those scripts for endpoints, authentication handling, and any data exfiltration (unexpected remote hosts). Be cautious about the 'no text output' behavior — it will perform actions silently. If you cannot review the external scripts and config, treat the skill as untrusted.

「设计框架自动生成套件」的第二个 skill，负责接收设计需求、生成框架文档、调用生图 prompt 脚本、发送预览到群组。

触发条件

群消息包含 @huluxiaojinganghuluwa（或你配置的 mention），且 /tmp/design-framework-lock 不存在（无进行中的任务）。

执行流程

1. 原子锁：mkdir /tmp/design-framework-lock，防止并发触发
2. 去重检查：与上次任务对比，完全相同则提示"已完成过"
3. 需求校验：检测消息是否包含 ≥2 个设计需求字段（任务名称/尺寸/设计要求/文案等）
4. 参考图提取：如消息含图片附件，提取路径供后续使用
5. 生成设计框架：包含项目概述、设计定位、文案层级、视觉风格、版式结构、设计元素、字体建议、输出规范
6. 生成生图 Prompt：调用 generate_prompt.sh
7. 发送预览：群内发送框架预览 + 确认按钮

依赖脚本

所有脚本均位于 design-framework-sender/ 目录：

• generate_prompt.sh：调用 OpenRouter API 生成生图 prompt
• send_text.sh：发送文本消息到 Telegram
• config.py：统一配置读取

无文字输出

全程通过 exec 执行 bash，不输出任何说明文字。

安装说明

请参考 design-framework-sender skill 的安装文档。