Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ppt Light Corporate
v1.1.1Generate polished corporate PPTs using a light-themed company template. Activate when: (1) User asks to create/make/generate a PPT/PowerPoint/幻灯片/演示文稿 (2) Us...
⭐ 0· 53·0 current·0 all-time
by@ksfrist
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description and the included Python scripts (ppt_helpers, icon_library, ppt_qa, ppt_scorer) are coherent with a PPT-generation/QA/scoring tool. However SKILL.md and the code reference core asset files (assets/template-light.pptx and assets/icons-library.pptx) that are not present in the provided file manifest. The code also expects python-pptx, lxml, and related libraries but the skill declares no dependencies. These omissions are inconsistent with the stated purpose.
Instruction Scope
SKILL.md gives focused, template-specific instructions (build outline, wait for user confirmation, backup template, record feedback to memory/ppt-feedback.md). The runtime instructions do not ask for unrelated system data or network endpoints. Minor scope note: SKILL.md says feedback is recorded to memory/ppt-feedback.md but no corresponding implementation was found in the visible scripts — confirm where/whether feedback is actually persisted.
Install Mechanism
There is no install spec despite multiple Python scripts that import third-party packages (pptx/python-pptx, lxml). The skill will fail or behave unpredictably if the runtime environment lacks these packages. Also, the manifest omits binary/template assets the code expects; failure to include those assets is a red flag for incomplete packaging or distribution mistakes.
Credentials
The skill declares no required environment variables, credentials, or config paths. The code shown does not attempt to read environment secrets or reach out to external services — behavior is local to files and python-pptx objects, which is proportionate to the stated function.
Persistence & Privilege
The skill is not marked always:true and uses normal autonomous invocation defaults. The scripts read and write PPTX files (e.g., tb.save) and will create output files; that's expected for a generator. There is no evidence the skill modifies other skills or global agent config.
What to consider before installing
What to check before using or installing this skill:
- Missing assets: SKILL.md and the code require assets/template-light.pptx and assets/icons-library.pptx but those files are not present in the manifest. Ask the author to provide those files or confirm paths, otherwise the code will raise errors when loading the template or copying icons.
- Undeclared dependencies: The Python scripts import python-pptx and lxml (and use pptx utilities). The skill package does not declare installation steps or dependencies. Ensure your environment has python-pptx, lxml, and any other required Python packages before running; consider running in a sandboxed environment.
- Data writes: The tool will write PPTX output (e.g., tb.save('output.pptx')) and SKILL.md mentions recording feedback to memory/ppt-feedback.md. Confirm where files are written and that file locations are acceptable for you (no unexpected system paths).
- Runtime errors and index safety: icon_library.copy_icon uses shape indices from icon-index.json to index into shapes in icons-library.pptx. If the assets PPTX differs, this can throw index errors or produce incorrect shapes — verify the icons PPTX matches the index JSON.
- No network activity in visible code: The provided scripts do not make network calls or read environment secrets, which is good. Still, ask for the missing assets and a dependency list (requirements.txt) or an install spec to avoid surprises.
- Recommended steps: request the missing asset files and a requirements list, run the code in an isolated/test environment, inspect full file set for any additional scripts not shown, and only then use the skill with production data.Like a lobster shell, security has layers — review code before you run it.
latestvk9708pawzbqts9tzczkgaj2qgh84tkwc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
