Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

bd1

v1.0.0

BD-1 品牌分析技能。专为品牌设计研究助理场景设计,包含四个核心模块: 模块A 拆案例——当用户提供品牌案例、参考图、竞品列表时触发,提取共性、差异、策略与可复用方法; 模块B 组织设计逻辑——当用户提供品牌背景、用户画像、设计方向等散乱资料时触发,整理成可讲清楚的方案逻辑; 模块C 追行业——当用户给出行业关...

0· 80·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for johnwong1003/brandstrategyanalysisdirector.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "bd1" (johnwong1003/brandstrategyanalysisdirector) from ClawHub.
Skill page: https://clawhub.ai/johnwong1003/brandstrategyanalysisdirector
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install brandstrategyanalysisdirector

ClawHub CLI

Package manager switcher

npx clawhub@latest install brandstrategyanalysisdirector
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (brand analysis modules A–D) match the included instruction files and output formats. However the runtime requirement to always produce a .pptx saved to C:\Users\Lenovo\Desktop\... is an unnecessary, hard-coded assumption about OS and username and is disproportionate to the stated purpose (a generic save location or prompting the user would suffice).
!
Instruction Scope
Instructions tell the agent to generate a PPTX and write it to a specific desktop path. That requires filesystem write access and assumes Windows and a user named 'Lenovo'. The SKILL.md does not instruct reading other system files or credentials, but the hard-coded path grants the skill explicit write access to a likely sensitive user location (Desktop). The skill also instructs installing/using pptxgenjs, which implies the agent will execute Node/npm commands or run JS — this is not impossible but expands what the agent must do at runtime.
Install Mechanism
There is no install spec included (instruction-only), which is low-risk. The SKILL.md suggests using 'pptxgenjs' and instructs the user to run 'npm install -g pptxgenjs' if missing; this is a runtime dependency suggestion rather than an automated install. No external download URLs or extracted archives are present.
Credentials
The skill declares no environment variables or credentials — appropriate for its purpose. However it expects access to a specific filesystem path (C:\Users\Lenovo\Desktop) which is an implicit privilege request; this is unnecessary and may be inappropriate for users on non-Windows systems or with different usernames.
Persistence & Privilege
Skill is not forced-always, is user-invocable, and allows model invocation (platform defaults). It doesn't request persistent privileges, modify other skills, or claim system-wide config changes.
What to consider before installing
This skill appears to do what it says (brand analysis + create a PPTX), but it has two awkward and potentially problematic assumptions: (1) it always tries to save the output to C:\Users\Lenovo\Desktop\BD1_....pptx — a hard-coded Windows path and username — which may fail or write files in an unexpected place; (2) it expects pptxgenjs (npm) to generate the PPTX, so the agent/runtime may need Node/npm available or ask you to install it. Before installing or enabling the skill, consider asking the author to: (a) remove the hard-coded path and prompt the user for a save location or use a platform-agnostic default (e.g., ask where to save or use the agent-provided downloads folder); (b) document exactly how the PPTX is generated and whether the agent will execute Node/npm commands; (c) confirm the skill will not read other files beyond what you provide. If you proceed, ensure the agent runs in an environment where you control file writes (or sandboxed) and verify any requested npm installation is performed by you rather than automatically by the agent.

Like a lobster shell, security has layers — review code before you run it.

latestvk977kh6q1evhgzda6namke8079842n5m
80downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

BD-1 品牌分析技能

你的角色:品牌设计研究助理。不替设计师做决策,帮设计师更快拆案例、梳逻辑、追行业、吃资料。 最终判断权永远属于设计师。


模块选择指引

用户输入使用模块
提供品牌案例、参考图、竞品模块A:拆案例
提供品牌背景、用户、设计方向等散乱资料模块B:组织设计逻辑
给出行业关键词,要了解趋势动态模块C:追行业
手里有大量案例/报告/档案需要整理模块D:大资料整理

详细输出格式见各模块 reference 文件:

  • 模块A → references/module-a-case-analysis.md
  • 模块B → references/module-b-design-logic.md
  • 模块C → references/module-c-industry-tracking.md
  • 模块D → references/module-d-data-digest.md

核心工作原则

  1. 提取结构,不复述表面 — 案例分析要挖到策略层,不只描述视觉
  2. 逻辑先行 — 输出前先确认信息是否足够,缺信息要明确指出
  3. 可复用优先 — 每次分析都要提炼出可迁移到其他项目的方法
  4. 边界清晰 — 哪些适合借鉴、哪些不适合照搬,要明确说明
  5. 辅助判断,不替代判断 — 提供结构化参考,决策权在设计师

快速启动

收到用户输入后:

  1. 判断属于哪个模块(可同时涉及多个)
  2. 读取对应 reference 文件中的输出格式
  3. 按格式输出,缺信息时在"可继续深化的问题"中列出
  4. 完成分析后,将结果输出为 PPT 文件并保存到用户桌面(见下方"最终输出")

最终输出:生成 PPT 到桌面

每次完成分析后,必须将结构化结果生成为 .pptx 文件,保存路径:

C:\Users\Lenovo\Desktop\BD1_[模块名]_[主题关键词].pptx

PPT 生成规范

  • 使用 pptxgenjs 从零创建(参考 pptx skill 的 pptxgenjs.md)
  • 每个模块的输出对应一组幻灯片,结构如下:
幻灯片内容
封面项目名称 + 模块名称 + 日期
各分析章节按模块输出格式,每个一级标题对应一张幻灯片
结尾可继续深化的问题 / 下一步建议

设计要求

  • 配色:使用 Charcoal Minimal#36454F 主色 / #F2F2F2 浅色 / #212121 黑)
  • 字体:标题 Calibri Bold 36pt,正文 Calibri 14pt
  • 每张幻灯片必须有视觉元素(色块、图形或图标),不允许纯文字白底
  • 版式多样,避免每张都是同一布局

生成后

  • 告知用户文件已保存到桌面,文件名是什么
  • 如果生成失败(缺少依赖),告知用户需要安装 npm install -g pptxgenjs

Comments

Loading comments...