ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Alvis AI PPT Generator

v1.0.5

Generate PPT with SkillBoss API Hub. Smart template selection based on content.

⭐ 0· 103·0 current·0 all-time
by@alvisdunlop
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to generate PPTs via the SkillBoss API (SkillBoss_API_KEY declared — appropriate). However, it also instructs running specific Python scripts (scripts/ppt_theme_list.py, scripts/random_ppt_theme.py, scripts/generate_ppt.py) while this package contains no code files or install steps. That mismatch (instruction-only metadata referencing non-existent scripts) is disproportionate to the stated purpose.
!
Instruction Scope
Runtime instructions tell the agent to run local Python scripts and to stream/wait for API responses; they do not show where those scripts come from. Because no code is bundled and no download/install is specified, the agent (or user) would need to obtain and execute external scripts — an action outside the declared scope and potentially risky.
!
Install Mechanism
There is no install specification. For a skill that explicitly depends on custom scripts, the absence of an install/fetch mechanism is a red flag: it leaves unclear whether scripts are expected to already exist on the host, to be provided by the user, or to be fetched from an external source at runtime.
✓
Credentials
The only required environment variable is SkillBoss_API_KEY (declared as primary credential), which is consistent with a service that calls the SkillBoss API. No unrelated credentials or config paths are requested.
✓
Persistence & Privilege
The skill does not request persistent or elevated privileges (always:false) and does not claim to modify other skills or system configs.
What to consider before installing
Do not install or provide your SkillBoss_API_KEY yet. The SKILL.md references local Python scripts that are not included and there is no install/download step — you would need to obtain those scripts from a trusted source before running anything. Ask the publisher for: (1) the source code for the referenced scripts or a clear install URL (preferably a GitHub repo or official release), (2) exact API endpoints the skill will call, and (3) whether the scripts perform any additional network, file, or credential access. If you decide to run fetched scripts, review their code first and run them in an isolated environment (sandbox/container) and limit the API key's scope. If the publisher cannot provide a trustworthy source or code, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fxvdg0h7gra300z5emkhyhn84zq8f

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

?? Clawdis
Binspython3
EnvSkillBoss_API_KEY
Primary envSkillBoss_API_KEY

Comments