Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Beamer Pipeline Public

v0.2.1

Convert academic papers or notes into Chinese academic Beamer slides using a seven-phase local pipeline with pluggable agent execution and LaTeX compilation.

0· 31·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ccmxigua/beamer-pipeline-public.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Beamer Pipeline Public" (ccmxigua/beamer-pipeline-public) from ClawHub.
Skill page: https://clawhub.ai/ccmxigua/beamer-pipeline-public
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install beamer-pipeline-public

ClawHub CLI

Package manager switcher

npx clawhub@latest install beamer-pipeline-public
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description (convert papers to Chinese Beamer slides) matches the code and templates. The scripts implement the seven phases, asset localization, symbol/slide helpers, and final acceptance checks. No environment variables, unrelated binaries, or external services are required by the skill itself, so capability and purpose align.
Instruction Scope
Runtime instructions are scoped to preparing a workspace, localizing remote Markdown images, producing JSON artifacts, optionally invoking an agent process via --agent-cmd, and optionally running LaTeX. The only potentially surprising behaviors are: (1) prepare_task_assets.js will perform network fetches for any Markdown image URLs found (this is expected for image localization but does cause outbound HTTP requests to the hosts of those URLs), and (2) the skill writes prompt files and then executes whatever command you pass to --agent-cmd to generate or repair artifacts. The SKILL.md does not instruct reading unrelated system files or hidden credentials.
Install Mechanism
There is no install spec — this is an instruction/CLI package distributed with Node.js scripts. No remote downloads or archive extracts are performed by the skill itself. Node 18+ is required (declared), which is consistent with the code usage (fetch, etc.).
Credentials
The skill requires no credentials or special env vars. It optionally reads LATEXMK_BIN (and uses process.env only for that default). The main privacy/reach concern is network access: image localization will make outbound HTTP requests to arbitrary URLs found in the input, which can reveal that a specific document was processed to those remote hosts. Also, the skill executes user-supplied agent and LaTeX commands which may access local files or network resources depending on what you provide — but that is a user-provided risk, not an undeclared credential request.
Persistence & Privilege
The skill does not request permanent platform privileges (always: false) and does not modify other skills or global agent settings. It writes outputs and a local cache under the output directory you provide; this is expected and documented.
Assessment
This package appears to do what it says: convert paper/notes into a local Beamer workspace and help run a seven‑phase pipeline. Before using it, consider: (1) If your source Markdown contains remote image URLs, the tool will fetch them (outbound HTTP requests) and cache them under the output directory — do not run it on documents with private or ephemeral URLs you don't want contacted. (2) You must supply any agent runtime via --agent-cmd; that command will be executed by the skill and will have whatever network/file access you grant it — only use a trusted agent command. (3) If you enable LaTeX compilation, the skill will invoke your system LaTeX tool (latexmk/xelatex) which can read files from the working directory; run in an isolated workspace if processing untrusted inputs. Overall the package is coherent and contains no hidden credentials or surprising external endpoints, but treat agent-cmd and remote-image fetching as the primary operational risks.
scripts/run_beamer_public.js:129
Shell command execution detected (child_process).
!
scripts/prepare_task_assets.js:33
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

academicvk979z824c0xa67f53tq4kzdcfn85q42dbeamervk979z824c0xa67f53tq4kzdcfn85q42dlatestvk979z824c0xa67f53tq4kzdcfn85q42dlatexvk979z824c0xa67f53tq4kzdcfn85q42dpipelinevk979z824c0xa67f53tq4kzdcfn85q42dslidesvk979z824c0xa67f53tq4kzdcfn85q42d
31downloads
0stars
2versions
Updated 8h ago
v0.2.1
MIT-0

Beamer Pipeline Public

Convert academic papers or structured paper notes into a Chinese academic Beamer deliverable through the same seven-phase pipeline shape as the original /beamer shortcut, while keeping the public package free of private Telegram queue, worker, session, and local-path coupling.

What this skill does

This skill provides a publishable, local-first Beamer pipeline runner. It preserves the original seven-stage contract:

  1. analysis / 分析: build analysis.json with paragraph, figure, table, equation, notation, and formal-statement ledgers.
  2. slides_outline_skeleton / slides 大纲: build slides.json with roadmap, conclusion preview, body/appendix split, and slide skeletons.
  3. equation_coverage / 公式覆盖: resolve equation_coverage to concrete slide/frame mappings.
  4. notation_consistency / 记号一致性: resolve notation_coverage, first visible definitions, and cross-slide consistency.
  5. compile_and_structural_repair / 编译与结构修复: produce main.tex, compile or repair main.pdf, and check structural alignment.
  6. review_and_auto_rework / reviewer 审核与自动返工: convert reviewer failures into repair work and revalidate.
  7. final_acceptance_delivery / 终验与交付: package final artifacts and require ready-for-review acceptance fields.

The public runner creates phase prompts, phase logs, state files, workspace contracts, and local validation gates. Agent execution is intentionally pluggable via --agent-cmd so that ClawHub users can attach their own OpenClaw or LLM runtime without shipping Yilin's private Telegram worker/session implementation.

Deliverable folder

The pipeline writes one canonical output directory containing, as phases progress:

  • analysis.json
  • slides.json
  • main.tex
  • main.pdf when LaTeX compilation succeeds
  • README.md
  • asset_manifest.json
  • figures/
  • beamer_task_contract.md
  • beamer_pipeline_state.json
  • beamer_phase_log.jsonl
  • phase_<n>_<name>_prompt.md

Inputs

  • A source document path, usually Markdown converted from a paper, or a paper-note file.
  • An output directory.
  • Optional execution flags for dry-run, single-phase execution, validation, asset preparation, LaTeX command, and agent command.

CLI usage

node scripts/run_beamer_public.js --input paper.md --out out --dry-run
node scripts/run_beamer_public.js --input paper.md --out out --init-only
node scripts/run_beamer_public.js --input paper.md --out out --phase 1 --agent-cmd 'your-agent --prompt {prompt}'
node scripts/run_beamer_public.js --input paper.md --out out --validate-phase 5

Supported options:

  • --init-only: prepare workspace, localized assets, and contract only.
  • --dry-run: print the seven-phase plan and required artifacts.
  • --phase <1-7>: run one phase.
  • --validate-phase <2-6>: validate existing artifacts for a phase gate.
  • --agent-cmd <command>: command used to produce/repair artifacts for each phase.
  • --latex-cmd <command>: LaTeX command for phase 5, default LATEXMK_BIN or latexmk.
  • --skip-assets: skip prepare_task_assets.js.

--agent-cmd placeholders:

  • {prompt}: generated phase prompt file path, shell-quoted.
  • {phase}: phase index.
  • {phaseName}: phase name.
  • {out}: output directory, shell-quoted.
  • {input}: source file path, shell-quoted.

Quality contract

A generated deck should:

  • Preserve all source figures, tables, subfigures, and appendix figures/tables when available.
  • Expand slide count as needed; any target slide count is a lower bound, not a cap.
  • Include a roadmap page and conclusion-preview page.
  • Use formal Chinese academic presentation style.
  • Separate formal statements from intuition when both are needed.
  • Give full faithful Chinese translations for crucial theorem/proposition/lemma/corollary/definition/assumption statements.
  • Keep visible slide text free of internal scaffold labels such as core_message, source_paragraph_ids, paragraph_ledger, 核心信息, 来源段落, 这页负责, and 服务于未读论文听众.
  • Track figure/table/equation/notation/formal-statement coverage explicitly.
  • Define symbols, abbreviations, operators, and hyperparameters on first visible use using source-grounded definitions.

Included scripts

  • scripts/run_beamer_public.js: public seven-phase runner.
  • scripts/beamer_phase_blueprint.js: original seven-phase names, goals, required artifacts, and planned-coverage gates.
  • scripts/prepare_task_assets.js: localizes markdown image URLs into figures/ and writes asset_manifest.json.
  • scripts/beamer_acceptance_contract.js: validates final structured Beamer acceptance fields.
  • scripts/deck_symbol_canonicalization.js: shared symbol canonicalization helper.
  • scripts/slide_schema.js: shared slide/equation block normalization helper.

Dependencies

Required:

  • Node.js 18+ or newer

Optional:

  • A LaTeX distribution such as TeX Live or MacTeX
  • latexmk or xelatex for compiling main.tex to main.pdf
  • An OpenClaw or other agent runtime wired through --agent-cmd

Privacy and portability notes

This public package intentionally excludes:

  • Telegram bot tokens and session targets
  • .openclaw runtime state
  • SQLite task databases
  • launchd worker configuration
  • private OpenClaw runtime/session/database orchestration code
  • executable upstream reference snapshots
  • user-specific logs and caches
  • private source PDFs or historical task outputs

Do not publish generated paper decks unless you have the right to redistribute their source content and figures.

Comments

Loading comments...