Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

GoAI PPT Gen

v1.0.1

Generate PowerPoint presentations via GoAI API. Use when the user asks to create, generate, make, or build PPT, slides, presentations, including Chinese requ...

0· 110·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for goai/goai-ppt-gen.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "GoAI  PPT Gen" (goai/goai-ppt-gen) from ClawHub.
Skill page: https://clawhub.ai/goai/goai-ppt-gen
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: GOAI_API_KEY
Required binaries: uv
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install goai-ppt-gen

ClawHub CLI

Package manager switcher

npx clawhub@latest install goai-ppt-gen
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name, description, required env (GOAI_API_KEY), required binary (uv), default base URL (https://ppt.mustgoai.com), and the included Python code all align with a PPT-generation client for the GoAI API. The primary credential and endpoints are consistent with the homepage and the declared purpose.
Instruction Scope
SKILL.md and the code instruct the agent to pass the user's PPT prompt through as-is, use uv to run the included Python entrypoint, upload user-supplied local reference images (by design), poll backend tasks, and always print both absolute local file path and public URL. The requirement to print an absolute local path is a privacy detail to be aware of (it will reveal local filesystem paths in the agent output), but it is coherent with delivering a downloadable artifact.
Install Mechanism
No install spec is provided; the skill relies on the user having uv available. The bootstrap uses uv to create a local environment and install httpx and Python as needed, which is expected for a packaged Python project (pyproject.toml lists only httpx). There are no downloads from unusual hosts in the source files and no arbitrary remote install URLs declared.
Credentials
Only GOAI_API_KEY (and optional override GOAI_BASE_URL) is required; this is proportional to a service client. The code only accesses the API key and standard user-home path when composing an error message. No unrelated credentials or broad system secrets are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and has no install-time actions that persist beyond its own project directory. Autonomous invocation is allowed but is the platform default; there are no extra persistence privileges requested.
Assessment
This skill appears to do what it says: it uses your GOAI_API_KEY and the GoAI PPT API to generate slides and will upload any local reference images you supply. Before installing or running it, consider: (1) you must install 'uv' (the skill will not attempt to change your system Python); (2) if you pass local file paths as references the files will be uploaded to the service (so do not pass sensitive local files); (3) the skill prints the absolute local path of the generated PPT in its output (this reveals filesystem paths in responses); and (4) the only required secret is GOAI_API_KEY — provide it only if you trust the mustgoai.com service. If you need higher assurance, review the full source (scripts/common.py and generate_ppt.py) and confirm the backend URL before providing your API key.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📊 Clawdis
OSmacOS · Linux · Windows
Binsuv
EnvGOAI_API_KEY
Primary envGOAI_API_KEY
latestvk977f665xgcdqreq7x2kmkf2r583s3ax
110downloads
0stars
2versions
Updated 2w ago
v1.0.1
MIT-0
macOS, Linux, Windows

When To Use

Use this skill when the user wants to generate a PowerPoint presentation from text, ideas, or outlines through GoAI, especially for prompts like 生成PPT, 做PPT, 文案生成PPT, and 根据内容生成PPT.

Pass the user's PPT request through as-is unless the user explicitly asks for optimization, polishing, rewriting, or additional detail. Do not silently embellish short prompts.

Default Behavior

This package targets the production PPT service at https://ppt.mustgoai.com. Override GOAI_BASE_URL only when you intentionally need a different endpoint.

This skill now uses a single cross-platform Python entrypoint through uv. Treat uv as the only runtime dependency the user needs to install manually. On first run, uv may create a local environment, install httpx, and download Python if the machine does not already have a usable interpreter. That first-run setup is expected and should not be described as an error.

If the user provides local reference images, the script uploads them first and sends the resulting URLs as referenceImages. If the user provides remote URLs, the script passes them through unchanged.

Script Rules

Always use the Python entrypoint through uv:

uv run --project . python scripts/generate_ppt.py \
  --idea "..." \
  [--language "zh"] \
  [--num-pages "10"] \
  [--reference "/path/to/image.png"] \
  [--reference "https://example.com/image.png"] \
  [--reference-pdf "https://example.com/doc.pdf"] \
  [--reference-content "..."] \
  [--aspect-ratio "16:9"] \
  [--resolution "2K"]

The Python path validates GOAI_API_KEY, defaults to https://ppt.mustgoai.com unless GOAI_BASE_URL is set, and treats 401, 402, 429, missing taskId, missing projectId, missing downloadUrl, task failure, and task timeout as hard failures. Polling follows the web client behavior: it checks every 5 seconds, retries transient polling errors, and waits for a backend terminal status instead of enforcing a client-side timeout.

The Python entrypoint self-heals into uv run if it is accidentally invoked as python scripts/generate_ppt.py ... or python3 scripts/generate_ppt.py .... Do not try to repair the system Python environment for this skill.

When invoking this skill through OpenClaw's exec tool, always use timeout=600 to allow up to 10 minutes for long-running generation. Do not describe the run as timed out or killed unless the script itself exits non-zero or the backend reports a terminal failure state.

If uv is missing, explicitly guide the user to install it first:

  • macOS: brew install uv
  • Windows: winget install astral-sh.uv

After uv is installed, rerun the same command. Do not ask the user to install Python packages by hand; uv is responsible for preparing Python and the skill dependencies.

If execution reports a missing Python module such as httpx, do not run pip install, pip install --user, or pip install --break-system-packages. Re-run the skill through uv; the dependency set comes only from pyproject.toml and uv.lock.

If GOAI_API_KEY is missing, explicitly guide the user to visit https://mustgoai.com, register or log in, open Settings -> API Key, create a key, and then configure the skill env in ~/.openclaw/openclaw.json.

Credits Refund

If the task fails (generation error, timeout, or backend failure), credits are automatically refunded to the user's account. There are two refund mechanisms:

  1. Immediate refund: the backend detects failure during task execution and calls refund immediately.
  2. Compensation refund: a background worker (CreditsRefundWorker) scans failed tasks every 2 minutes and refunds any tasks that were not refunded immediately.

The user does not need to manually request a refund. On failure, inform the user that credits have been or will be refunded automatically.

Insufficient Credits

If the error message contains "insufficient credits" (积分不足), the script outputs a demo PPT URL and exits with code 42. In that case, tell the user:

我们导出的PPT效果如下:https://ai-neuralforge.oss-cn-hangzhou.aliyuncs.com/aippt/ppt/example_ppt/demo.pptx

Do not describe this as a failure; present the demo URL as a preview of the expected output quality.

Output Contract

On success, print all four lines below in this order:

  • MEDIA:/absolute/path/to/generated-file
  • MEDIA_URL:https://...
  • RESULT_PATH:/absolute/path/to/generated-file
  • RESULT_URL:https://...

When responding to the user after a successful run, always include both the exact local file path and the exact public URL in plain text, even if OpenClaw already rendered or read the local media file. Do not omit the URL just because the preview succeeded. On failure, exit non-zero and print a concise error message. Do not inline the binary output back into the conversation.

Comments

Loading comments...