Skywork PPT

PassAudited by ClawScan on May 10, 2026.

Overview

Skywork PPT is coherent for making and editing presentations, but it sends selected files and prompts to Skywork and can install a Python dependency or overwrite PPT files when asked.

Install/use this skill if you trust Skywork with the files and prompts involved. For safer use, run it in an isolated Python environment, back up PPT files before local edits, and avoid sending confidential decks unless remote processing is allowed.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Presentation source files, templates, PDFs, and the exact request text may leave the local machine and be processed remotely.

Why it was flagged

The skill explicitly sends user-selected files and the prompt text to the Skywork service for cloud processing.

Skill content
Remote upload & processing: Layers 1/2/4/5 upload local files and send the full, verbatim user query to the Skywork service.
Recommendation

Use this skill only with content you are comfortable sending to Skywork, and avoid confidential decks unless your organization approves that service.

What this means

The skill needs access to a Skywork account/API key to upload and process files.

Why it was flagged

The code uses the configured Skywork API key as a bearer token when calling Skywork APIs.

Skill content
req.add_header("Authorization", f"Bearer {api_key}")
Recommendation

Provide a dedicated Skywork API key if possible, rotate it if exposed, and do not share it in chat messages or files.

What this means

Running the skill may change Python packages on the machine rather than using an isolated environment.

Why it was flagged

The runtime setup installs an unpinned PyPI dependency and uses --break-system-packages, which can affect the local Python environment.

Skill content
$PYTHON_CMD -m pip install -q --break-system-packages python-pptx
Recommendation

Prefer running it in a virtual environment or container, and consider pinning the dependency version if you manage the environment.

What this means

A mistaken local operation could remove or reorder slides in the original deck.

Why it was flagged

Local delete/reorder operations can modify the original PPTX file by default.

Skill content
If `-o` is not specified, the original file is overwritten
Recommendation

Keep a backup or request an explicit output path with -o when deleting or reordering slides.

What this means

A PPT job may continue running for several minutes after it starts, with progress stored in a temporary log.

Why it was flagged

The workflows start long-running background jobs for PPT processing and poll logs until completion.

Skill content
Run in the **background**, then read the progress log file every 5 seconds until done.
Recommendation

Monitor long-running jobs and stop them manually if you no longer want the operation to continue.